An unauthenticated cross-site request forgery and path traversal vulnerability in WWBN AVideo allows remote attackers to perform unauthorized recursive directory deletion.

The application fails to validate CSRF tokens and performs unsanitized concatenation of the key parameter in stopLive.php, enabling an unauthenticated attacker to manipulate file paths. By enticing an administrator to visit a malicious page, an attacker can trigger the recursive deletion of sensitive directories.

The ability to perform unauthorized directory deletion poses a severe risk to data integrity and service availability. With a CVSS score of 8.1, this high-severity flaw could lead to significant operational disruption, loss of media content, and potential system downtime for the AVideo platform.

Immediate Action: Review the official security advisory from WWBN and apply all available security updates or configuration changes provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests to stopLive.php, specifically identifying patterns involving directory traversal characters like double dots and slashes.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter incoming requests and block those containing suspicious path traversal sequences or unauthorized parameter inputs.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for total loss of directory data, organizations should treat this vulnerability with high priority. Administrators must restrict access to administrative endpoints and apply the latest vendor patches immediately to prevent unauthorized file system operations.