Description
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled account when an administrator views the video page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | — | — |
References
- GitHub Security Advisory (GHSA-7mqw-mqc3-ffjw) vendor-advisory
- VulnCheck Advisory: WWBN AVideo Cross-Site Request Forgery via videoEditLight.php third-party-advisory