Kurz gesagt
- CVE-2023-25313 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in wwbn/avideo, avideo (wwbn).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.3%, höher als bei 70.8% aller Schwachstellen.
- Abhilfe: auf 12.4 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| wwbn/avideo Packagist | < 12.4
| 12.4
|
| avideo | < 12.4
| 12.4
|
Description
Impact:
An attacker could execute remote code on a system running wwbn/avideo
Step to Reproduce:
- Go to the
My Videos tab
https://demo.avideo.com/mvideos
- Click "Embed a video link"
Append a command to the url as a query string. eg. ?whoami
then click Save
This issue has been resolved in commit 236228f15
NVD description
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free