Description (CNA)
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint accepts a `name` parameter via POST and passes it to `Plugin::getDatabaseFileName()` without any path traversal sanitization. This allows an authenticated admin (or an attacker via CSRF) to traverse outside the plugin directory and execute the contents of any `install/install.sql` file on the filesystem as raw SQL queries against the application database. Commit 81b591c509835505cb9f298aa1162ac64c4152cb contains a patch.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WWBN / AVideo | affected <= 26.0 |
CWE
CWE-22
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-3hwv-x8g3-9qpr
- https://github.com/WWBN/AVideo/commit/81b591c509835505cb9f298aa1162ac64c4152cb
ADP enrichment
No English description supplied.
No references supplied.