PT-2026-26562 · Avideo · Avideo
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
AVideo versions prior to 8.0
Description
AVideo is a video-sharing platform. Versions prior to 8.0 contain a SQL Injection issue in the
getSqlFromPost() method of Object.php. The $ POST['sort'] array keys are used directly as SQL column identifiers within an ORDER BY clause. While real escape string() was applied, it only escapes string-context characters and does not protect SQL identifiers, rendering it ineffective. The issue stems from the direct use of unsanitized input in constructing a SQL query. The sort parameter within the $ POST request is particularly vulnerable.Recommendations
Versions prior to 8.0 should be upgraded to version 8.0.
As a workaround without upgrading, apply a WAF rule to block POST requests where any
sort[*] key contains characters outside [A-Za-z0-9 ].
Alternatively, restrict access to the queue view (queue.json.php, index.php) to trusted IP ranges only.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Avideo