CVE-2026-28501: WWBN AVideo SQL Injection Vulnerability

CVE-2026-28501 Overview

WWBN AVideo is an open source video platform that contains a critical unauthenticated SQL Injection vulnerability. Prior to version 24.0, the application fails to properly sanitize the catName parameter when supplied via a JSON-formatted POST request body within the objects/videos.json.php and objects/video.php components. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses existing sanitization mechanisms, allowing attackers to execute arbitrary SQL commands without authentication.

Critical Impact

This unauthenticated SQL Injection vulnerability allows remote attackers to extract sensitive data, modify database contents, or potentially achieve remote code execution through database-specific exploitation techniques, all without requiring any authentication.

Affected Products

• WWBN AVideo versions prior to 24.0
• objects/videos.json.php component
• objects/video.php component

Discovery Timeline

• 2026-03-06 - CVE-2026-28501 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-28501

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from a fundamental flaw in how the AVideo application processes user input from JSON-formatted POST requests. The vulnerability exists because the application's security architecture performs global input sanitization on the $_REQUEST superglobal before JSON payloads are parsed and merged into it. This race condition in the input processing pipeline allows attackers to inject malicious SQL statements through the catName parameter after security checks have already been completed.

The affected endpoints objects/videos.json.php and objects/video.php accept JSON-encoded data via POST requests, and the parsed values are directly used in SQL queries without proper escaping or parameterization. This architectural oversight creates a bypass of the existing XSS and SQL injection protections implemented elsewhere in the codebase.

Root Cause

The root cause is improper input validation where JSON input parsing occurs after global security sanitization checks have been executed. When the application merges JSON-parsed data into $_REQUEST, the values bypass the xss_esc() function and are not passed through mysqli->real_escape_string() before being used in SQL queries. This timing issue in the input processing pipeline creates a window where unsanitized data reaches the database layer.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft a malicious JSON POST request containing SQL injection payloads in the catName parameter. The payload is sent directly to the vulnerable endpoints and processed without sanitization, allowing the attacker to manipulate SQL queries executed by the application.

The following patch from the security fix demonstrates the proper implementation of SQL escaping that was missing:

         if (!empty($_GET['q'])) {
             global $global;
             $search = strtolower(xss_esc($_GET['q']));
+            $search = $global['mysqli']->real_escape_string($search);
 
             $like = [];
             $searchFields = static::getSearchFieldsNames();

Source: GitHub Commit Reference

The fix adds mysqli->real_escape_string() to properly sanitize user input before it is used in SQL queries.

Detection Methods for CVE-2026-28501

Indicators of Compromise

• Unusual SQL error messages in application logs originating from objects/videos.json.php or objects/video.php
• HTTP POST requests with JSON bodies containing SQL keywords (UNION, SELECT, OR 1=1, etc.) in the catName parameter
• Unexpected database query patterns or data exfiltration attempts in database audit logs
• Authentication bypass attempts or unauthorized data access patterns

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect JSON-encoded SQL injection payloads targeting the catName parameter
• Monitor HTTP access logs for POST requests to /objects/videos.json.php and /objects/video.php with suspicious JSON content
• Enable database query logging and alert on queries containing injection signatures from the affected endpoints
• Deploy intrusion detection signatures for SQL injection patterns in JSON request bodies

Monitoring Recommendations

• Enable verbose logging on the AVideo application to capture all requests to the affected endpoints
• Configure database audit logging to track queries originating from the web application
• Set up alerts for failed or unusual SQL query patterns that may indicate exploitation attempts
• Monitor for data exfiltration indicators such as large data transfers or unusual database dump operations

How to Mitigate CVE-2026-28501

Immediate Actions Required

• Upgrade WWBN AVideo to version 24.0 or later immediately
• If immediate patching is not possible, disable public access to the vulnerable endpoints
• Review database logs for signs of prior exploitation
• Consider resetting database credentials if compromise is suspected

Patch Information

The vulnerability has been addressed in WWBN AVideo version 24.0. The fix ensures that all user-supplied input, including JSON-parsed parameters, is properly escaped using mysqli->real_escape_string() before being used in SQL queries. Organizations should upgrade to version 24.0 or later to remediate this vulnerability.

For detailed patch information, see the GitHub Security Advisory GHSA-pv87-r9qf-x56p and the GitHub Release Note 24.0.

Workarounds

• Implement a reverse proxy or WAF rule to block requests containing SQL injection patterns in JSON bodies to the affected endpoints
• Restrict access to the affected endpoints (/objects/videos.json.php and /objects/video.php) to trusted IP addresses only
• Apply the manual patch from commit 0c10be68 if upgrading is not immediately feasible
• Disable JSON input processing for the affected endpoints until a full upgrade can be completed

# Example: Block access to vulnerable endpoints using nginx
location ~ ^/objects/(videos\.json|video)\.php {
    # Restrict to internal networks only until patched
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}