A chain of vulnerabilities in the CloneSite plugin of AVideo allows an unauthenticated attacker to first obtain clone secret keys from the /clones.json.php endpoint. The exposed keys reveal an improper access control flaw (CWE‑284). These keys enable a full database dump via /cloneServer.json.php, exposing admin password hashes stored as MD5, which can be cracked easily. After gaining administrative credentials, the attacker exploits an OS command injection flaw (CWE‑78) in cloneClient.json.php, allowing arbitrary system command execution.

The vulnerability affects the WWBN AVideo platform, all releases up to version 26.0. No other vendors or products are listed as affected.

The CVSS score of 10.0 indicates highest severity, and the EPSS score of 13% indicates a moderate exploitation probability, suggesting that while exploitation is not yet widespread, the vulnerability remains actionable. The attack vector is purely unauthenticated HTTP access to the exposed clone endpoints, requiring no prior authentication. Once the admin credentials are obtained from the database dump, the OS command injection enables full compromise. The vulnerability is not yet listed in the CISA KEV catalog, but its high severity warrants immediate attention.