En resumen
- CVE-2023-25313 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a wwbn/avideo, avideo (wwbn).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.3%, mayor que el 70.8% de las vulnerabilidades.
- Solución: actualizar a 12.4 o posterior.
| Package | Affected versions | Patched versions |
|---|
| wwbn/avideo Packagist | < 12.4
| 12.4
|
| avideo | < 12.4
| 12.4
|
Description
Impact:
An attacker could execute remote code on a system running wwbn/avideo
Step to Reproduce:
- Go to the
My Videos tab
https://demo.avideo.com/mvideos
- Click "Embed a video link"
Append a command to the url as a query string. eg. ?whoami
then click Save
This issue has been resolved in commit 236228f15
NVD description
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free