CVE-2025-34433

EIP tracks 1 public exploit for CVE-2025-34433. Includes Metasploit module exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated RCE vulnerability in AVideo by leveraging a predictable salt generation mechanism and multiple information disclosure vulnerabilities to decrypt and execute arbitrary PHP code via the `notify.ffmpeg.json.php` endpoint.

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.