AVideo Encoder getImage.php Unauthenticated Command Injection

MetasploitMetasploit exploitExploitRubyexploit_linux/http/avideo_encoder_getimage_cmd_injection

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit module that exploits CVE-2026-29058, an unauthenticated OS command injection in AVideo Encoder's getImage.php endpoint. It sends a crafted GET request with a base64-encoded URL containing a command substitution payload to achieve arbitrary command execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard exploit for CVE-2026-29058, an OS command injection vulnerability in AVideo Encoder. The module sends a crafted HTTP GET request with a command injection payload to the target's getImage.php endpoint. No backdoor, deceptive payload, or concealed operator-directed harm is present. The module's behavior is consistent with its documented purpose of exploiting the stated vulnerability.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareAVideo Encoder
Attack typesOS command injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a fully functional exploit that sends a malicious request to execute arbitrary OS commands on the target. It includes both a check method for vulnerability detection and an exploit method that delivers a payload for command execution.

modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:100-103modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:105-110

Requirements

  • Target must be running a vulnerable version of AVideo Encoder (< 7.0) with the getImage.php endpoint accessible.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:18-19

Observed behavior

  • Sends a GET request to /Encoder/objects/getImage.php with a base64Url parameter containing a base64-encoded URL and an injected shell command.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:105-110
  • The check method confirms vulnerability by measuring response time after injecting sleep commands.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:75-98
  • The exploit method sends the Metasploit payload encoded as a command, replacing spaces with ${IFS}.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:100-103
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
payload.encoded.gsub(' ', '${IFS}')The exploit method substitutes spaces in the Metasploit payload with ${IFS} to avoid shell parsing issues, a standard technique for command injection exploits.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:102
Exploit Target Endpoint
/Encoder/objects/getImage.phpThe module targets the vulnerable endpoint described in the CVE, sending a crafted base64Url parameter containing a command injection.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:107-109
Review boundaries

What the analysis did not establish

  • Analysis is based on module source code and metadata only; framework mixins, libraries, and external payloads are not expanded.
  • No network traffic or runtime behavior was observed; classification relies solely on static code analysis.
  • Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • The actual payload executed on the target is determined by the Metasploit framework at runtime and is not included in the reviewed evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1