This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Unauthenticated Remote Code Execution (RCE) in WWBN AVideo. ๐ฅ **Consequences**: Attackers can execute arbitrary PHP code on the server.โฆ
๐ก๏ธ **Root Cause**: Improper input validation in `submitIndex.php`. ๐ **Flaw**: The `systemRootPath` parameter is passed directly to `require_once` without sanitization.โฆ
๐ฆ **Affected Versions**: WWBN AVideo **v12.4** through **v14.2**. ๐งฉ **Component**: The `WWBNIndex` plugin. ๐ **System**: PHP-based video platform. Any installation within this version range is vulnerable.
Q4What can hackers do? (Privileges/Data)
๐ป **Privileges**: Full Remote Code Execution (RCE). ๐ **Data**: Attackers can read/write files, access databases, and execute system commands. ๐ต๏ธ **Impact**: Complete server takeover.โฆ
๐ **Threshold**: **LOW**. ๐ซ **Auth**: No authentication needed (Unauthenticated). ๐ก **Config**: Exploitable via standard HTTP POST requests to `submitIndex.php`. Anyone on the internet can attempt exploitation.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฅ **Public Exp**: **YES**. Multiple PoCs exist on GitHub (e.g., Chocapikk, Jhonsonwannaa, dream434). ๐ **Tools**: Python scripts available for automated exploitation.โฆ
๐ **Self-Check**: Scan for `submitIndex.php` in the `WWBNIndex` plugin directory. ๐ก **Test**: Send a crafted POST request with `systemRootPath` pointing to a malicious PHP file.โฆ
๐ฉน **Official Fix**: Update AVideo to a version **> v14.2**. ๐ข **Note**: The vendor (WWBN) should release a patch. Until then, treat all versions 12.4-14.2 as compromised.โฆ
๐ง **Workaround**: Block external access to `submitIndex.php` via WAF or Nginx/Apache config. ๐ซ **Mitigation**: Disable the `WWBNIndex` plugin if not needed.โฆ
๐จ **Urgency**: **CRITICAL**. ๐ด **Priority**: Immediate action required. Unauthenticated RCE is a top-tier threat. Patch immediately or isolate the server. Do not ignore this vulnerability.