critical9.6
CVE-2023-25313
AVideo contains Command injection when embedding a video link
Impact
Impact: An attacker could execute remote code on a system running wwbn/avideo Step to Reproduce: 1. Go to the `My Videos` tab https://demo.avideo.com/mvideos 2. Click "Embed a video link" Append a command to the url as a query string. eg. `?whoami` then click Save This issue has been resolved in commit `236228f15`
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | wwbn/avideo | < 12.4 | 12.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wwbn | Avideo | before 12.4 |