A critical Cross-Site Request Forgery vulnerability in WWBN AVideo allows remote attackers to compromise site integrity by tricking an authenticated administrator into executing unauthorized configuration changes.

The application fails to validate the origin of requests to the configuration update endpoint, allowing an attacker to force a logged-in administrator to perform administrative actions without their knowledge. This vulnerability stems from the absence of CSRF protection mechanisms, such as tokens or header validation, on the /updateConfig endpoint.

Successful exploitation allows an attacker to rewrite critical site parameters, including SMTP credentials, the encoder URL, and the site header HTML. This can lead to full administrative account takeover, data exfiltration, or the injection of malicious content into the video platform, resulting in significant reputational damage and loss of system integrity. The CVSS score of 8.3 indicates a high level of severity, primarily driven by the potential for total impact on system configuration and integrity.

Immediate Action: Upgrade to the latest version of WWBN AVideo once a patched release is made available by the vendor, or apply the fix provided in commit f9492f5e6123dff0292d5bb3164fde7665dc36b4.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /updateConfig or objects/configurationUpdate.json.php endpoints, specifically those originating from unexpected referrers.

Compensating Controls: Implement strict SameSite cookie policies at the web server or application level and utilize a Web Application Firewall to block requests that lack proper origin validation or anti-CSRF tokens.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete site configuration compromise, organizations running WWBN AVideo must treat this vulnerability with high priority. Administrators should monitor for unauthorized configuration modifications while awaiting an official patched release from the vendor. Applying the upstream fix commit is recommended for environments where an immediate version update is not yet possible.