AVideo contains Command injection when embedding a video link

심각 9.8CVE-2023-25313 · GHSA-pgvh-p3g4-86jw · Published 25/04/2023 · updated 17/06/2026

요약

CVE-2023-25313은(는) wwbn/avideo, avideo (wwbn)에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.3%, 전체 취약점의 70.8%보다 높음.
조치: 12.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
wwbn/avideo Packagist	`< 12.4`	`12.4`
avideo wwbn	`< 12.4`	`12.4`

Description

Impact:

An attacker could execute remote code on a system running wwbn/avideo

Step to Reproduce:

Go to the My Videos tab

https://demo.avideo.com/mvideos

Click "Embed a video link"

Append a command to the url as a query string. eg. ?whoami

then click Save

This issue has been resolved in commit 236228f15

NVD description

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.

References

WWBN/AVideo security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-30842 · ADVISORY
WWBN/AVideo commit 236228f · WEB
WWBN/AVideo · PACKAGE

wwbn/avideo의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

wwbn/avideo

Packagist

< 12.4

12.4

avideo

wwbn

< 12.4

12.4

Description

Impact:

An attacker could execute remote code on a system running wwbn/avideo

Step to Reproduce:

Go to the My Videos tab

https://demo.avideo.com/mvideos

Click "Embed a video link"

Append a command to the url as a query string. eg. ?whoami

then click Save

This issue has been resolved in commit 236228f15

NVD description

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.

wwbn/avideo의 다른 취약점

모두 보기 →