An OS Command Injection vulnerability (CWE-78) in getID3 allows attackers to execute arbitrary system commands on the underlying host when processing audio/video files with crafted filenames containing shell metacharacters.
In multiple helperapp shell-out handlers, arguments including $file , $this->filename , and $temp were directly concatenated into command strings passed to shell_exec() without being escaped via escapeshellarg() :
getid3/getid3.php ( getHashdata() , line ~1843): The Windows code path for vorbiscomment.exe concatenated $file , $empty , and $temp with simple double-quote wrapping.
getid3/write.vorbiscomment.php ( WriteVorbisComment() , lines 90 & 105): Both Windows and Linux paths directly concatenated $this->filename and $tempcommentsfilename into the vorbiscomment command line.
getid3/module.audio.shorten.php (line ~135): The Windows path concatenated $info['filenamepath'] into shorten.exe .
Supplying a media file named: test.ogg"; id > /tmp/rce_proof; echo " When WriteVorbisComment() is executed, the shell parses the semicolon separator and executes the injected id command with the privileges of the web server/PHP process user. Command execution succeeds even if the underlying binary ( vorbiscomment ) is missing from the system.
Remote Code Execution (RCE) on systems running getID3 (e.g. WordPress, ClassicPress, media uploaders) whenever media files with crafted filenames are processed.
Patched by applying escapeshellarg() to all file path arguments passed into shell_exec() across getid3.php , write.vorbiscomment.php , and module.audio.shorten.php .
Commits: 2c6f3f96546f05746405872848114754ed7fe9b4 and ce598c4f3823441d878c5a7a2a9f2f703a3e10b6
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
