Description (CNA)
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WWBN / AVideo | affected 0 through c3edcc274c389816d434acadac07ee78eaf330c1 |
CWE
CWE-352
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-v2q3-cpm3-r8pq
- https://www.vulncheck.com/advisories/avideo-yptwallet-savebalance-php-cross-site-request-forgery
ADP enrichment
No English description supplied.
No references supplied.