{"uuid": "10508330-fd53-4415-9bf0-c81f70924168", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31819", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/avideo_wwbnindex_unauth_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"Valentin Lobstein\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution (RCE) vulnerability\\n          in the WWBNIndex plugin of the AVideo platform. The vulnerability exists within the\\n          `submitIndex.php` file, where user-supplied input is passed directly to the `require()`\\n          function without proper sanitization. By exploiting this, an attacker can leverage the\\n          PHP filter chaining technique to execute arbitrary PHP code on the server. This allows\\n          for the execution of commands and control over the affected system. The exploit is\\n          particularly dangerous because it does not require authentication, making it possible\\n          for any remote attacker to exploit this vulnerability.\", \"disclosure_date\": \"2024-04-09\", \"fullname\": \"exploit/multi/http/avideo_wwbnindex_unauth_rce\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"AVideo WWBNIndex Plugin Unauthenticated RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/avideo_wwbnindex_unauth_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/avideo_wwbnindex_unauth_rce\", \"references\": [\"CVE-2024-31819\", \"URL-https://github.com/WWBN/AVideo\", \"URL-https://chocapikk.com/posts/2024/cve-2024-31819\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Automatic\", \"PHP In-Memory\", \"Unix In-Memory\", \"Windows In-Memory\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:42.576710Z"}