OS Command Injection Vulnerability in getID3

• •Critical OS Command Injection vulnerability in getID3 affects multiple platforms.
• •Attackers can exploit the flaw to achieve Remote Code Execution via crafted filenames.
• •Patches have been released to mitigate the vulnerability by escaping command arguments.

An OS Command Injection vulnerability (CWE-78) was discovered in getID3, allowing attackers to execute arbitrary commands on the host system when processing specially crafted audio/video filenames. The vulnerability affects systems using getID3, including WordPress and ClassicPress, and can lead to Remote Code Execution (RCE). Attackers can exploit this flaw by supplying a media file with a crafted filename, such as 'test.ogg"; id > /tmp/rce_proof; echo "', which allows command execution with the privileges of the web server/PHP process user. The issue was patched by applying escapeshellarg() to all file path arguments passed into shell_exec() in multiple files. The vulnerability is critical due to its potential for widespread exploitation across various platforms that utilize getID3 for media processing.