GHSA-pgvh-p3g4-86jw

ghsaUSosv

AVideo contains Command injection when embedding a video link

view advisory published 2023-02-02Licence: CC-BY-4.0

Impact: An attacker could execute remote code on a system running wwbn/avideo Step to Reproduce: 1. Go to the `My Videos` tab https://demo.avideo.com/mvideos 2. Click "Embed a video link" Append a command to the url as a query string. eg. `?whoami` then click Save This issue has been resolved in commit `236228f15`

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-25313US	critical9.8	1.31% (71st)	—	2023-04-25
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link…

references

External citations — patches, advisories, analysis.

https://github.com/WWBN/AVideoPACKAGE
https://github.com/WWBN/AVideo/commit/236228f15a9a31be5a0e60f05dac043682e49a5eWEB
https://github.com/WWBN/AVideo/security/advisories/GHSA-pgvh-p3g4-86jwWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-30842ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan