Centova Cast Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Centova Cast version 3.2.12. This issue allows attackers to overload the system by repeatedly accessing the database export API endpoint. Exploitation of this vulnerability can lead to 100% CPU usage by sending multiple concurrent requests to the /api.php endpoint with manipulated parameters.

Impact

Exploitation of this vulnerability causes the application to consume 100% of the CPU resources on all cores, leading to a significant degradation of service.

Reproduction

The vulnerability can be reproduced by sending multiple concurrent requests to the /api.php endpoint, using a reseller or admin username and password. The requests should include parameters that trigger the database export action, effectively causing the server to process the requests simultaneously and exhaust CPU resources.