CyberRota Analysis
AI-GeneratedAVideo versions up to 29.0 are susceptible to an OS command injection vulnerability in the ffmpeg.json.php endpoint, allowing attackers to manipulate the notifyCode and callback parameters to execute arbitrary shell commands. This could lead to unauthorized access and control over the web server, posing a significant risk to system integrity. Organizations using AVideo should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.