AVideo-Encoder: pre-authentication streamer-login SQL injection

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at objects/login.json.php passes the user parameter to Streamer::get in objects/Streamer.php, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although objects/security.php strips literal single quotes, html_entity_decode in objects/Login.php restores entity-encoded quotes before the query. The supplied siteURL must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set canUpload or isAdmin to reach Streamer::createIfNotExists. That function calls Streamer::get before its additional allowlist check. UNION results are exposed through streamers_id, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ncoder/security/advisories/GHSA-2rrq-xf8q-3qpf Diğer
• github.com/…ommit/8a6e2b8aedb87702656636d3fc8d9e26e559a762 Diğer
• github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0 Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:54Yayımlandı

İlgili açıklar

• 4,7 CVE-2026-61575AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
• 7,3 CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpoints
• 8,6 CVE-2026-61572AVideo-Encoder: unauthenticated full-response server-side request forgery
• 6,1 CVE-2026-61573AVideo-Encoder: reflected cross-site scripting in the login interface
• 10,0 CVE-2026-61567AVideo-Encoder: unauthenticated command execution through streamer login trust
• 10,0 CVE-2026-61564AVideo-Encoder: unauthenticated installer PHP code injection