ID:12564 - Exploit for SQL injection in AVideo - CVE-2026-28501

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary SQL queries and disclose sensitive information.

The vulnerability exists due to sql injection in objects/videos.json.php and objects/video.php when processing the catName parameter from a JSON-formatted POST request body. A remote attacker can send a specially crafted JSON request to execute arbitrary SQL queries and disclose sensitive information.

JSON input is parsed and merged into $_REQUEST after global security checks are executed, allowing the payload to bypass the existing sanitization mechanisms.

Remediation