In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin\/CloneSite\/cloneClient.json.php (line ~270) the stored SSH password is substituted into the command string `sshpass -p ‘{password}’ rsync …` with a plain str_replace and no escaping, so a single quote in the password breaks out of the quoted word and injects arbitrary shell. The password is written through the admin-only endpoint objects\/pluginAddDataObject.json.php, whose only CSRF defense (isUntrustedRequest()\/forbidIfIsUntrustedRequest()) is a no-op when the request source appears to be loopback \u2014 as happens behind a same-host TLS-terminating reverse proxy with $global[‘trustedProxies’] unset \u2014 or when an attacker-controlled application is co-hosted on the same hostname; on HTTPS the session cookie is issued with SameSite=None, so a cross-site POST carries it. An unauthenticated remote attacker can therefore lure an authenticated administrator into planting a malicious password (and an attacker-controlled cloneSiteURL), after which the plugin’s documented crontab entry executes the injected command with no further administrator action, as the crontab owner (commonly root or www-data). Exploitation requires the CloneSite plugin to be enabled with the documented crontab installed and one of the above CSRF channels; default single-process Apache deployments are reported as not CSRF-exploitable. This is a residual sink of CVE-2026-41304. The issue is confirmed at master HEAD (8963b6a1); no patched version is available.<\/p>\n","protected":false},"excerpt":{"rendered":"
In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin\/CloneSite\/cloneClient.json.php (line ~270) the stored SSH password is substituted into the command <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25167","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}