An OS command injection vulnerability in WWBN AVideo allows authenticated attackers to execute arbitrary system commands, posing a critical risk to server integrity and data confidentiality.

This is an OS command injection flaw (CWE-78) occurring in the restreamer endpoint, where the application fails to sanitize user-controlled users_id and liveTransmitionHistory_id values. An authenticated user can leverage these parameters to inject shell metacharacters and achieve remote code execution on the underlying host.

The ability to execute arbitrary commands provides an attacker with full control over the application server. This can lead to complete data exfiltration, unauthorized modification of video content, or the installation of persistent backdoors, severely impacting business operations and user trust. Given the CVSS score of 8.8, this vulnerability represents a high-risk security deficiency that requires immediate attention.

Immediate Action: Update to the latest version of AVideo or apply the fix provided in commit 99b865413172045fef6a98b5e9bfc7b24da11678 to sanitize inputs.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected shell commands originating from the web server user account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block shell metacharacters such as backticks or $() within JSON request bodies.

Public Exploit Available: No (There is no confirmed public weaponized exploit or published PoC in the provided data).

The severity of this vulnerability, combined with the presence of a known proof-of-concept, necessitates rapid remediation. Organizations utilizing AVideo should prioritize applying the upstream patch immediately to prevent potential system compromise by authenticated actors. If patching is not immediately feasible, restrict access to the restreamer endpoint until the fix is deployed.