WWBN AVideo is an open source video platform. In versions up to and including 29.0, an incomplete fix for AVideo's `test.php` adds `escapeshellarg` for wget but leaves the `file_get_contents` and `curl` code paths unsanitized, and the URL validation regex `/^http/` accepts strings like `httpevil[.]com`. Commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 contains an updated fix.
The incomplete fix applied the `escapeshellarg` function only for `wget` calls, while code paths based on `file_get_contents` and `curl` remain vulnerable to malicious data injection. Additionally, URL validation relies on the regular expression `/^http/`, which accepts strings such as `httpevil[.]com` — without actual domain validity verification. An attacker can craft an appropriately malicious URL that bypasses validation and leads to unintended system command execution through unsecured code paths.
An unauthorized remote attacker can execute arbitrary system commands on the server (RCE/command injection), which may result in disclosure of sensitive data or modification of system resources.
Apply the fix contained in commit 78bccae74634ead68aa6528d631c9ec4fd7aa536 available in the WWBN AVideo project GitHub repository. It is recommended to update to a version containing this fix and verify that the earlier commit (1e6cf03e93b5a5318204b010ea28440b0d9a5ab3) is not the only applied patch.
WWBN AVideo in versions up to and including 29.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NWwbn Avideo
APPWwbn≤ 29.0
Related vulnerabilities
WWBN AVideo: RCE przez eval() w pluginie YPTSocket — przejęcie kont
SQL Injection w WWBN AVideo — mechanizm uwierzytelniania RTMP
WWBN AVideo: hasła do filmów przechowywane w bazie jako plaintext
SSRF w WWBN AVideo — brak walidacji parametru URL w saveDVR.json.php
RCE bez uwierzytelnienia w WWBN AVideo — łańcuch podatności w pluginie CloneSite