Em resumo
- CVE-2023-25313 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta wwbn/avideo, avideo (wwbn).
- Chance de exploração nos próximos 30 dias (EPSS): 1.3%, maior que 70.8% das vulnerabilidades.
- Correção: atualize para 12.4 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| wwbn/avideo Packagist | < 12.4
| 12.4
|
| avideo | < 12.4
| 12.4
|
Description
Impact:
An attacker could execute remote code on a system running wwbn/avideo
Step to Reproduce:
- Go to the
My Videos tab
https://demo.avideo.com/mvideos
- Click "Embed a video link"
Append a command to the url as a query string. eg. ?whoami
then click Save
This issue has been resolved in commit 236228f15
NVD description
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free