WWBN AVideo versions up to 29.0 contain an OS command injection vulnerability (CWE-78) in the test.php script. The vulnerability stems from an incomplete sanitization of user-supplied URLs: while the wget command path uses escapeshellarg, the file_get_contents and curl paths do not sanitize inputs properly. The URL validation regex /^http/ is insufficient, allowing malicious URLs that start with 'http' but are not valid HTTP URLs. This flaw can lead to command injection, potentially allowing an attacker to execute arbitrary OS commands remotely without authentication. The vulnerability has a CVSS 3.1 score of 9.3 (critical). A code commit has been made to address the issue, but no official patch or advisory is currently documented.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected server, leading to a complete compromise of confidentiality and partial integrity impact. Availability is not impacted. The high CVSS score reflects the ease of exploitation and the severity of impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has made a code commit (78bccae74634ead68aa6528d631c9ec4fd7aa536) that updates the fix for this vulnerability. Users should monitor WWBN's official channels for an official patch or update and apply it promptly once available. Until then, avoid using vulnerable versions (<= 29.0) in production environments or restrict access to the affected test.php script to trusted users only.