A chain of vulnerabilities in the CloneSite plugin of AVideo allows an unauthenticated attacker to first obtain clone secret keys from the /clones.json.php endpoint. These keys enable a full database dump via /cloneServer.json.php, exposing admin password hashes stored as MD5, which can be cracked with little effort. After gaining administrative credentials, the attacker can exploit an OS command injection flaw in the rsync command construction of /cloneClient.json.php, allowing arbitrary system command execution. This sequence results in complete remote code execution on the underlying server.

The vulnerability affects the WWBN AVideo platform, all releases up to version 26.0. No other vendors or products are listed as affected.

The CVSS score of 10.0 indicates highest severity, and the EPSS score of 11% suggests low current exploitation probability, though the vulnerability is still actionable. The attack vector is purely unauthenticated HTTP access to the exposed clone endpoints, requiring no prior authentication. Once the admin credentials are obtained from the database dump, the OS command injection enables full compromise. The vulnerability is not yet listed in the CISA KEV catalog, but its high severity warrants immediate attention.