CyberRota Analysis
AI-GeneratedThe vulnerability exists in the videoAddViewCount.json.php endpoint of WWBN AVideo, where insufficient validation of video access permissions allows authenticated attackers to manipulate view counts and watch-time metrics for videos they are not authorized to access. This could lead to misleading analytics and potential reputational damage for content creators. Organizations using AVideo should prioritize this issue to prevent abuse of their video metrics and maintain the integrity of their platform.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint before updating view statistics. Authenticated attackers can increment view counts and watch-time on videos they cannot access by submitting requests with arbitrary video IDs.