Duplicate Advisory: AVideo contains Command injection when embedding a video link
Critical severity
GitHub Reviewed
Published
Apr 25, 2023
to the GitHub Advisory Database
•
Updated Nov 11, 2023
Withdrawn
This advisory was withdrawn on Apr 27, 2023
Description
Published by the National Vulnerability Database
Apr 25, 2023
Published to the GitHub Advisory Database
Apr 25, 2023
Reviewed
Apr 27, 2023
Withdrawn
Apr 27, 2023
Last updated
Nov 11, 2023
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pgvh-p3g4-86jw. This link is maintained to preserve external references.
Original Description
Impact:
An attacker could execute remote code on a system running wwbn/avideo
Step to Reproduce:
My Videostabhttps://demo.avideo.com/mvideos
Append a command to the url as a query string. eg.
?whoamithen click Save
This issue has been resolved in commit
236228f15References