PT-2023-23010 · Avideo · Avideo

Jmrcsnchz

·

Published

2023-04-27

·

Updated

2026-04-17

·

CVE-2023-30854

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 12.4
Description An OS Command Injection issue in the authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. The vulnerable code executes a command that includes user-controlled input, specifically the cloneSiteURL variable, which can be manipulated through the admin panel's clone site feature. By hosting a specially crafted cloneServer.json.php file, an attacker can inject malicious commands, leading to remote code execution. This issue is exploited by sending a GET request to the vulnerable endpoint.
Recommendations For versions prior to 12.4, update to version 12.4 to resolve the issue. As a temporary workaround, consider restricting access to the /plugin/CloneSite/cloneClient.json.php endpoint until the update is applied. Additionally, restrict the ability to control the cloneSiteURL variable through the admin panel to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-30854
GHSA-6VRJ-PH27-QFP3

Affected Products

Avideo