In short
- CVE-2023-25313 is a CRITICAL (CVSS 9.8) vulnerability affecting wwbn/avideo, avideo (wwbn).
- Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 70.8% of all vulnerabilities.
- Fix: update to 12.4 or later.
| Package | Affected versions | Patched versions |
|---|
| wwbn/avideo Packagist | < 12.4
| 12.4
|
| avideo | < 12.4
| 12.4
|
Description
Impact:
An attacker could execute remote code on a system running wwbn/avideo
Step to Reproduce:
- Go to the
My Videos tab
https://demo.avideo.com/mvideos
- Click "Embed a video link"
Append a command to the url as a query string. eg. ?whoami
then click Save
This issue has been resolved in commit 236228f15
NVD description
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free