Impact Analysis

This vulnerability allows any authenticated user, including non-admin streamers, to perform SQL injection attacks by submitting crafted POST parameters.

• Attackers can extract sensitive database information such as credentials, configuration data, and all queue data.
• It enables time-based or boolean-based blind SQL injection attacks.
• Attackers can cause denial of service by executing heavy or malicious queries.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-33025 is a SQL Injection vulnerability in the AVideo-Encoder project, specifically in the getSqlFromPost() method of Object.php. The vulnerability occurs because the $_POST['sort'] array keys are used directly as SQL column identifiers inside an ORDER BY clause without proper sanitization. Although real_escape_string() was applied, it only escapes characters relevant in string contexts and does not protect SQL identifiers, making it ineffective here."}, {'type': 'paragraph', 'content': 'This allows an authenticated user to inject arbitrary SQL code by crafting malicious sort parameters, potentially manipulating the ORDER BY clause to execute unintended SQL commands.'}, {'type': 'paragraph', 'content': "The issue was fixed by sanitizing column names to allow only alphanumeric characters and underscores, enclosing them in backticks, and restricting sort directions to 'asc' or 'desc'."}] [1, 2]

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring POST requests to the affected AVideo-Encoder endpoints, specifically looking for POST parameters named sort[*] that contain characters outside the allowed set of alphanumeric characters and underscores ([A-Za-z0-9_]).'}, {'type': 'paragraph', 'content': 'One approach is to inspect web server logs or use network monitoring tools to filter and identify suspicious POST requests with unusual characters in the sort parameter keys.'}, {'type': 'paragraph', 'content': 'For example, using command-line tools like grep on web server access logs to find such requests:'}, {'type': 'list_item', 'content': 'grep -P "POST.*sort\\[[^A-Za-z0-9_]" /var/log/apache2/access.log'}, {'type': 'list_item', 'content': 'Or using tools like tcpdump or Wireshark to capture HTTP POST traffic and filter for suspicious sort parameters.'}, {'type': 'paragraph', 'content': 'Additionally, applying a Web Application Firewall (WAF) rule to block POST requests where any sort[*] key contains disallowed characters can help detect and prevent exploitation attempts.'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Upgrade AVideo-Encoder to version 8.0 or later, where the vulnerability has been fixed by sanitizing the sort POST parameters and enforcing strict whitelisting.
• If upgrading is not immediately possible, implement a Web Application Firewall (WAF) rule to block POST requests where any sort[*] key contains characters outside the allowed set [A-Za-z0-9_].
• Alternatively, restrict access to the queue-related views (queue.json.php, index.php) to trusted IP ranges only, reducing the risk of exploitation.

Useful 0 Not Useful 0