In breve
- CVE-2023-25313 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda wwbn/avideo, avideo (wwbn).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 70.7% delle vulnerabilità.
- Correzione: aggiornare a 12.4 o successiva.
| Package | Affected versions | Patched versions |
|---|
| wwbn/avideo Packagist | < 12.4
| 12.4
|
| avideo | < 12.4
| 12.4
|
Description
Impact:
An attacker could execute remote code on a system running wwbn/avideo
Step to Reproduce:
- Go to the
My Videos tab
https://demo.avideo.com/mvideos
- Click "Embed a video link"
Append a command to the url as a query string. eg. ?whoami
then click Save
This issue has been resolved in commit 236228f15
NVD description
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free