Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-37173. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This exploit demonstrates an information disclosure vulnerability in AVideo Platform 8.1, allowing unauthenticated user enumeration via a direct endpoint request. The PoC includes a sample response exposing sensitive user data, including hashed passwords and admin status.
Description
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
Exploits (1)
This exploit demonstrates an information disclosure vulnerability in AVideo Platform 8.1, allowing unauthenticated user enumeration via a direct endpoint request. The PoC includes a sample response exposing sensitive user data, including hashed passwords and admin status.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N