A critical CSRF vulnerability in WWBN AVideo allows an unauthenticated attacker to perform a complete takeover of platform functionality by tricking an administrator into executing malicious requests.

The application fails to implement CSRF token validation on the admin/save.json.php endpoint, which is further exacerbated by a permissive SameSite=None cookie policy. This allows an attacker to forge cross-origin requests that bypass standard security controls, effectively granting the ability to reconfigure authentication, payment, and cloud storage providers.

Successful exploitation leads to a complete compromise of the AVideo platform's configuration, which can result in unauthorized access to sensitive user data, financial loss through payment redirection, and total loss of system integrity. With a CVSS score of 8.1, this vulnerability poses a high risk to organizational operations and security posture, as it enables an attacker to manipulate the platform's core security and storage mechanisms.

Immediate Action: As no official patch is currently available, administrators should restrict administrative access to trusted IP addresses and ensure users are logged out of the AVideo admin console when browsing other websites.

Proactive Monitoring: Monitor server access logs for suspicious POST requests to admin/save.json.php originating from unexpected Referer or Origin headers.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized cross-origin requests to administrative endpoints and enforce strict Referer header validation for all management traffic.

Public Exploit Available: No (exploit_available: unknown).

Given the lack of a vendor-provided patch, organizations must treat this vulnerability with high urgency. Administrators are advised to implement the recommended compensating controls immediately to mitigate the risk of unauthorized configuration changes, and to maintain strict control over administrative sessions until a permanent software fix is released by the vendor.