WWBN AVideo is an open source video platform. In versions 29.0 and below, the "cloneServer.json.php" endpoint in the CloneSite plugin constructs shell commands using user-controlled input ("url" parameter) without proper sanitization. The input is directly concatenated into a "wget" command executed via "exec()", allowing command injection. An attacker can inject arbitrary shell commands by breaking out of the intended URL context using shell metacharacters (e.g., ";"). This leads to Remote Code Execution (RCE) on the server. Commit 473c609fc2defdea8b937b00e86ce88eba1f15bb contains a fix.