CVE-2022-30605

AVideo 11.6 has a flaw in how it manages user sessions that allows an attacker to trick a logged-in user into sending a specially crafted request, which then gives the attacker higher privileges in the system.

A session fixation or manipulation vulnerability in WWBN AVideo 11.6 (and dev master commit 3f7c0364) enables privilege escalation via crafted HTTP requests. The attack vector requires user interaction (social engineering or CSRF) to trigger privilege elevation. An unauthenticated attacker can exploit this to gain administrative or elevated access.