Description:

I found a very critical vulnerability on your open source program called RCE (Remote Code Execution) where an attacker can arbitrary execute code in the server

Impact:

An attacker could execute remote codes on your system

Step to Reproduce:

1. Go to My Videos tab

https://demo.avideo.com/mvideos

2. Click "Embed a video link"

3. Get your Burp Suite Collaborator link

Example:

o4ta880iz4vap09kaqw400po8fe52u.oastify.com

4. Now put this RCE payload in the Video Link field

http://o4ta880iz4vap09kaqw400po8fe52u.oastify.com?whoami

then click Save

5. Now go to BurpSuite Collaborator client and see the response

Video POC: https://youtu.be/aN8JZVc5zFM

Credits

• Jefferson Gonzales (Gonz)
• Link https://twitter.com/gonzxph