CVE-2023-32073 - CVE House
Back to Database
Status published High CVE-2023-32073

AVideo command injection vulnerability

Vulnerability Description

WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32073

Credits & Attribution

No credits recorded in the NVD database.

References

More from WWBN

View All →
CVE-2025-53084
A cross-site scripting (xss) vulnerability exists in the videosList page...
Critical 9
CVE-2025-50128
A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg...
Critical 9.6
CVE-2025-48732
An incomplete blacklist exists in the .htaccess sample of WWBN...
High 7.3
CVE-2025-46410
A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId...
Critical 9.6
CVE-2025-41420
A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri...
Critical 9.6

Affected Vendor

Affected Software

AVideo
Vulnerable Versions:
<= 12.4

Timeline

Official Publish: May 12th, 2023
Last Modified: January 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-77

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1105 Ingress Tool Transfer
Command and Control