A denial of service vulnerability in Centova Cast 3.2.12 allows authenticated attackers to exhaust system resources and crash the application by flooding the database export API.

The application fails to implement resource limits or throttling on the /api.php endpoint, allowing an authenticated user to initiate concurrent database export requests that consume all available CPU cycles.

Successful exploitation of this vulnerability results in a complete denial of service for the streaming management platform, rendering the service unavailable to administrators and end users. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to operational continuity, as an attacker with low-level credentials can effectively take the system offline without requiring administrative privileges.

Immediate Action: Update to the latest version of Centova Cast beyond 3.2.12 where resource throttling for API requests has been implemented.

Proactive Monitoring: Monitor system CPU utilization and web server access logs for anomalous, high-frequency requests directed at the /api.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) or rate-limiting rules at the load balancer level to restrict the number of concurrent API requests from a single user session.

Public Exploit Available: Yes, a proof-of-concept script exists in the Exploit Database (EDB-ID 47677).

The presence of a functional proof-of-concept and the ease of exploitation necessitate immediate attention. Organizations utilizing Centova Cast should prioritize updating the software to a patched version to prevent potential service disruption. If an immediate update is not feasible, implement strict rate limiting on the API to mitigate the risk of resource exhaustion.