CVE-2023-30854
published 2023-04-28CVE-2023-30854: AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
5.17%
91.4th percentile
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | < 12.4 | 12.4 |
| wwbn | avideo | <= 12.4 | — |
| wwbn | avideo | <= 12.4 | — |
| wwbn | avideo | >= 0 < 12.4 | 12.4 |
| wwbn | avideo | 0 – 12.4 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
WWBN AVideo command injection vulnerability
osv·2023-05-12·CVSS 8.8
CVE-2023-32073 [HIGH] WWBN AVideo command injection vulnerability
WWBN AVideo command injection vulnerability
# WWBN AVideo Authenticated RCE
A command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for [CVE-2023-30854](https://cve.report/CVE-2023-30854) which affects WWBN Avideo up to version 12.3
## Vulnerable Code
/plugin/CloneSite/cloneClient.json.php
```php
$json->sqlFile = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->sqlFile));
$json->videoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->videoFiles));
$json->photoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->photoFiles));
// get dump file
$cmd = "wget -O {$clonesDir}{$json->sqlFile} {$objClone->cloneSiteURL}videos/cache/clones/{$j
GHSA
WWBN AVideo command injection vulnerability
ghsa·2023-05-12·CVSS 8.8
CVE-2023-32073 [HIGH] CWE-77 WWBN AVideo command injection vulnerability
WWBN AVideo command injection vulnerability
# WWBN AVideo Authenticated RCE
A command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for [CVE-2023-30854](https://cve.report/CVE-2023-30854) which affects WWBN Avideo up to version 12.3
## Vulnerable Code
/plugin/CloneSite/cloneClient.json.php
```php
$json->sqlFile = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->sqlFile));
$json->videoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->videoFiles));
$json->photoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->photoFiles));
// get dump file
$cmd = "wget -O {$clonesDir}{$json->sqlFile} {$objClone->cloneSiteURL}videos/cache/clones/{$j
OSV
Remote code injection in wwbn/avideo
osv·2023-04-27
CVE-2023-30854 [HIGH] Remote code injection in wwbn/avideo
Remote code injection in wwbn/avideo
# WWBN Avideo Authenticated RCE - OS Command Injection
## Description
An OS Command Injection vulnerability in an Authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution.
Vulnerable code:
```php
$cmd = "wget -O {$clonesDir}{$json->sqlFile} {$objClone->cloneSiteURL}videos/cache/clones/{$json->sqlFile}";
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file");
exec($cmd . " 2>&1", $output, $return_val);
```
We can control `$objClone->cloneSiteURL` through the admin panel clone site feature.
`/plugin/CloneSite/cloneClient.json.php` sends a GET Request to `{$objClone->cloneSiteURL}/plugin/CloneSite/cloneServer.json.php`. I hosted a specially crafted `cloneServer.json.php` that prints t
GHSA
Remote code injection in wwbn/avideo
ghsa·2023-04-27
CVE-2023-30854 [HIGH] CWE-78 Remote code injection in wwbn/avideo
Remote code injection in wwbn/avideo
# WWBN Avideo Authenticated RCE - OS Command Injection
## Description
An OS Command Injection vulnerability in an Authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution.
Vulnerable code:
```php
$cmd = "wget -O {$clonesDir}{$json->sqlFile} {$objClone->cloneSiteURL}videos/cache/clones/{$json->sqlFile}";
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file");
exec($cmd . " 2>&1", $output, $return_val);
```
We can control `$objClone->cloneSiteURL` through the admin panel clone site feature.
`/plugin/CloneSite/cloneClient.json.php` sends a GET Request to `{$objClone->cloneSiteURL}/plugin/CloneSite/cloneServer.json.php`. I hosted a specially crafted `cloneServer.json.php` that prints t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-28
Published