GHSA-XR6F-H4X7-R6QP WWBN AVideo: RCE cause by clonesite plugin

Description Summary The cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input url parameter without proper sanitization. The input is directly concatenated into a wget command executed via exec, allowing command injection. An attacker can inje...

Command Injection

wwbn/avideo is vulnerable to Command Injection. The vulnerability exists due to improper input sanitization in cloneClient.json.php which allows an authenticated attacker to inject and execute arbitrary commands through the name field...