CyberRota Analysis
AI-GeneratedAVideo versions up to 29.0 are vulnerable due to an insecure direct object reference (IDOR) in the category deletion endpoint, allowing authenticated non-admin users with upload capabilities to delete any category's on-disk asset directory by sending a crafted POST request. This vulnerability could lead to significant data loss for affected installations, particularly where the usersCanCreateNewCategories setting is enabled. Organizations using AVideo should prioritize remediation to prevent potential asset deletion by unauthorized users.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce before passing the attacker-supplied $_REQUEST['id'] to Category::deleteAssets(), which recursively removes {systemRootPath}videos/categories/assets/{id}/. It omits the Category::userCanEditCategory() ownership check enforced by the sibling Category::delete(). On installations where the non-default usersCanCreateNewCategories setting is enabled, an authenticated non-admin user with the canUpload capability can send a POST request with an arbitrary category ID and recursively delete any category's on-disk asset directory (icons/images). Category records and videos are not deleted. As of the advisory publication no patched version was available.