Unauthenticated RCE in WWBN AVideo WWBNIndex submitIndex.php

This repository contains a single Metasploit module targeting an unauthenticated remote code execution (RCE) vulnerability (CVE-2024-31819) in the WWBNIndex plugin of the AVideo platform. The exploit leverages improper input sanitization in the submitIndex.php file, allowing attackers to use PHP filter chain techniques to execute arbitrary PHP code or system commands on the server. The module is weaponized, supporting multiple payloads (PHP, Unix, Windows) and does not require authentication, making it highly dangerous. The main endpoints targeted are /plugin/WWBNIndex/submitIndex.php for exploitation and /index.php for version checking. The exploit is effective against AVideo versions 12.4 through 14.2 with the vulnerable plugin enabled. The repository is structured as a standard Metasploit module, written in Ruby, and is ready for operational use within the Metasploit framework.

This repository provides a Python-based exploit for CVE-2024-31819, targeting the WWBNIndex plugin. The main exploit logic resides in 'exploit.py', which takes a target URL and a command to execute. It leverages a sophisticated PHP filter chain generator (implemented in 'php_filter_chain.py') to craft a payload that abuses PHP's stream filters, enabling remote code execution via a POST request to '/plugin/WWBNIndex/submitIndex.php'. The payload is a PHP snippet that executes arbitrary system commands and marks the output for easy parsing. The exploit saves successful results to 'output.txt'. The repository includes a 'requirements.txt' for dependencies (colorama, requests) and a README with usage instructions. The attack vector is network-based, requiring access to the vulnerable endpoint. No hardcoded IPs or domains are present; the endpoint path is fingerprintable. The exploit is operational, providing real command execution if the target is vulnerable.

This repository provides a weaponized exploit for CVE-2024-31819, a critical unauthenticated remote code execution (RCE) vulnerability in the WWBNIndex plugin of the AVideo platform (versions 12.4 to 14.2). The vulnerability is due to improper handling of the 'systemRootPath' POST parameter in submitIndex.php, which is used unsafely in a require_once statement, allowing arbitrary PHP code execution via PHP filter chains. The repository includes: - A Python exploit script (exploit.py) that can test single or multiple targets, check for vulnerable versions, and provide an interactive shell for command execution on compromised servers. It uses a helper (php_filter_chain.py) to generate the necessary PHP filter chain payloads. - A Metasploit module (modules/exploits/multi/http/avideo_wwbnindex_unauth_rce.rb) that automates exploitation and supports various payloads (PHP, Linux, Windows meterpreter, etc.), making the exploit highly customizable and operational. - Documentation and a detailed README describing the vulnerability, affected versions, exploitation steps, and usage instructions. The main attack vector is a network-based POST request to the /plugin/WWBNIndex/submitIndex.php endpoint, with a malicious 'systemRootPath' parameter. Successful exploitation grants unauthenticated attackers full command execution on the target server, with the ability to spawn reverse shells or run arbitrary commands. The exploit is mature, weaponized, and suitable for both manual and automated exploitation via Metasploit.