A critical OS command injection vulnerability in the AVideo Live plugin allows unauthenticated attackers to execute arbitrary system commands on the host server.

This is a command injection vulnerability where the execAsync function improperly handles user input. Even with basic sanitization, an attacker can use command substitution techniques to bypass security filters and execute unauthorized operating system commands as the web server user.

Successful exploitation allows an attacker to execute arbitrary commands on the host operating system. This typically results in a complete system compromise, enabling the attacker to install backdoors, pivot into the internal network, or destroy data. The CVSS score of 9.8 highlights the critical nature of this vulnerability.

Immediate Action: Update to AVideo version 29.0 or later to ensure the command execution functions are correctly secured against injection attacks.

Proactive Monitoring: Monitor server logs for shell-related commands or unusual process spawning, especially those related to the AVideo Live plugin and on_publish.php.

Compensating Controls: Implement strict file system permissions to limit the web server user's ability to execute system binaries and utilize a WAF to filter out common command injection patterns in incoming requests.

Public Exploit Available: No

Command injection vulnerabilities are among the most dangerous flaws for web applications. All instances of AVideo must be updated to version 29.0 immediately to address this critical security gap. If immediate patching is not possible, ensure the AVideo instance is isolated or access-restricted to minimize the attack surface.