CVE-2024-31819

CRITICAL

WWBN AVideo 12.4-14.2 - Remote Code Execution via systemRootPath Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2024-31819. PoCs published by Chocapikk, dream434, Valentin Lobstein, including Metasploit module exploits/multi/http/avideo_wwbnindex_unauth_rce.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-31819, an unauthenticated RCE vulnerability in the AVideo platform's WWBNIndex plugin. The exploit leverages improper input validation in the `submitIndex.php` file to execute arbitrary PHP code via a crafted `systemRootPath` parameter.

Description

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.

Exploits (3)

nomisec WORKING POC 4 stars
by Chocapikk · poc
https://github.com/Chocapikk/CVE-2024-31819

This repository contains a functional exploit for CVE-2024-31819, an unauthenticated RCE vulnerability in the AVideo platform's WWBNIndex plugin. The exploit leverages improper input validation in the `submitIndex.php` file to execute arbitrary PHP code via a crafted `systemRootPath` parameter.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: AVideo platform with WWBNIndex plugin (versions 12.4 to 14.2)
No auth needed
Prerequisites: Target running vulnerable AVideo platform with WWBNIndex plugin · Network access to the target's `submitIndex.php` endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by dream434 · poc
https://github.com/dream434/CVE-2024-31819

This repository contains a functional exploit for CVE-2024-31819, leveraging PHP filter chains to achieve remote code execution (RCE) via a crafted payload sent to a vulnerable endpoint. The exploit uses a series of PHP iconv conversions to bypass restrictions and execute arbitrary commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Unknown (likely a PHP-based web application with vulnerable plugin)
No auth needed
Prerequisites: Python 3.x · requests library · target URL with vulnerable endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Valentin Lobstein · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/avideo_wwbnindex_unauth_rce.rb

This Metasploit module exploits an unauthenticated RCE vulnerability in the AVideo WWBNIndex plugin by leveraging PHP filter chaining to execute arbitrary code via the `require()` function in `submitIndex.php`. It supports multiple payload types (PHP, Unix, Windows) and includes version checking for vulnerability confirmation.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: AVideo Platform with WWBNIndex plugin (versions 12.4 to 14.2)
No auth needed
Prerequisites: Target running vulnerable AVideo version with WWBNIndex plugin · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.8587
EPSS Percentile 99.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-94
Status published
Products (2)
wwbn/avideo 12.4 - 14.2
wwbn/avideo 12.4 - 14.3Packagist
Published Apr 10, 2024
Tracked Since Feb 18, 2026