WWBN AVideo vulnerable to RCE caused by clonesite plugin

WWBN AVideo's CloneSite plugin allows attackers to run arbitrary commands on the server by injecting shell commands through the URL parameter. This happens because user input is directly used in a system command without being checked first.

The cloneServer.json.php endpoint in the CloneSite plugin constructs shell commands by concatenating unsanitized user input (url parameter) into a wget command executed via exec(), enabling command injection. An unauthenticated attacker can inject arbitrary shell metacharacters to break out of the intended URL context and achieve Remote Code Execution with server privileges.