Administrator-triggered phishing via CSRF email dispatch

Cross-site request forgery in AVideo sendEmail.json.php allows remote attackers to send branded phishing mail through an administrator. The endpoint treats an administrator session as CAPTCHA-valid, while its security allowlist skips the same-origin check, so a cross-origin POST supplies arbitrary recipient, subject, and body values. An authenticated administrator must visit an attacker-controlled page; the message is sent from the site's contact identity and can pass its email-authentication checks.