CVE-2024-53615

CVE-2024-53615 Karl Ward 的 files.gallery v0.3.0 至 0.11.0 版本中视频缩略图渲染组件存在命令注入漏洞，允许远程攻击者通过精心构造的视频文件执行任意代码。 前置条件： PATH 中存在 ffmpeg config.php：'allowupload' = true PHP 配置中必须启用 exec 漏洞位于以下行（取自版本 0.9.12），该行用于生成视频预览： $cmd = $ffmpegpath . ' -ss 3 -t 1 -hidebanner -i "' . strreplace'"', '"', $this-path . '"...

CVE-2024-53615

A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file...

CVE-2024-53615

A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file...

CVE-2024-53615: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file...

CVE-2024-53615

A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file...