ID:12660 - Exploit for CRLF injection in AVideo

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data in Scheduler downloadICS.php. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

Remediation