Описание
AVideo contains Command injection when embedding a video link
Impact:
An attacker could execute remote code on a system running wwbn/avideo
Step to Reproduce:
- Go to the
My Videostab
https://demo.avideo.com/mvideos
- Click "Embed a video link"
Append a command to the url as a query string. eg. ?whoami
then click Save
This issue has been resolved in commit 236228f15
Пакеты
Наименование
wwbn/avideo
composer
Затронутые версииВерсия исправления
< 12.4
12.4
Связанные уязвимости
CVSS3: 9.8
nvd
почти 3 года назад
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.