CyberRota Analysis
AI-GeneratedAVideo versions up to 29.0 are vulnerable to an OS command injection due to the unsanitized handling of keyword parameters in the listFFmpegProcesses() function. This flaw allows attackers to execute arbitrary OS commands with the privileges of the web server user by crafting a malicious payload. Organizations using AVideo should prioritize patching this vulnerability to mitigate the risk of unauthorized command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.