CVE-2026-33025: Wwbn Avideo-encoder SQLi Vulnerability

CVE-2026-33025 Overview

CVE-2026-33025 is a SQL Injection vulnerability affecting the AVideo video-sharing platform. The vulnerability exists in the getSqlFromPost() method within Object.php, where the $_POST['sort'] array keys are used directly as SQL column identifiers inside an ORDER BY clause. Although real_escape_string() was applied, this function only escapes string-context characters (quotes, null bytes) and provides no protection for SQL identifiers, making it entirely ineffective in this context.

Critical Impact

Authenticated attackers can exploit this SQL Injection vulnerability to manipulate database queries, potentially leading to unauthorized data access and data manipulation through the ORDER BY clause injection point.

Affected Products

• wwbn avideo-encoder (versions prior to 8.0)

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33025 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33025

Vulnerability Analysis

This SQL Injection vulnerability demonstrates a common security misconception regarding the use of real_escape_string() for SQL injection prevention. The function is designed to escape special characters in string literals by handling quotes and null bytes. However, when user input is used as a SQL identifier (such as a column name in an ORDER BY clause), escaping string characters provides no security benefit.

The vulnerable code in the getSqlFromPost() method directly incorporates user-controlled array keys from $_POST['sort'] into the ORDER BY clause of SQL queries. An attacker with low privileges can manipulate these sort parameters to inject arbitrary SQL syntax, potentially extracting sensitive information or modifying query behavior.

The attack surface is network-accessible and requires only low-level authentication, with no user interaction needed for exploitation. The vulnerability impacts both confidentiality and integrity of data, though availability appears to remain unaffected.

Root Cause

The root cause is improper input validation of SQL identifiers. The developers incorrectly assumed that real_escape_string() would sanitize column names used in ORDER BY clauses. SQL identifiers require different validation than string literals—specifically, they should be validated against a whitelist of allowed column names or restricted to alphanumeric characters and underscores only.

Attack Vector

The attack is conducted over the network by an authenticated user sending malicious POST requests to endpoints that process sorting parameters (such as queue.json.php or index.php). The attacker crafts the sort[*] array keys to include SQL metacharacters that escape the intended column identifier context, allowing injection of arbitrary SQL clauses.

// Vulnerable code (before patch) - Source: GitHub Security Advisory
if (!empty($_POST['sort'])) {
    $orderBy = [];
    foreach ($_POST['sort'] as $key => $value) {
        /**
         * @var array $global
         */
        $key = $global['mysqli']->real_escape_string($key);
        $value = $global['mysqli']->real_escape_string($value);
        $orderBy[] = " {$key} {$value} ";
    }
    $sql .= " ORDER BY " . implode(",", $orderBy);
}

Source: GitHub Commit Changes

Detection Methods for CVE-2026-33025

Indicators of Compromise

• Unusual characters in sort[*] POST parameters including SQL metacharacters such as semicolons, parentheses, quotes, or comment sequences
• Error logs containing SQL syntax errors related to ORDER BY clauses
• Unexpected database query patterns or execution times from the queue view endpoints
• POST requests to queue.json.php or index.php with abnormally long or complex sort parameter keys

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block POST requests where sort[*] keys contain characters outside the alphanumeric and underscore character set [A-Za-z0-9_]
• Implement SQL query monitoring to flag ORDER BY clauses with unexpected syntax patterns
• Review application logs for repeated parameter manipulation attempts targeting sort functionality

Monitoring Recommendations

• Enable detailed logging for all requests to queue.json.php and index.php endpoints
• Monitor database query logs for anomalous ORDER BY clause constructions
• Set up alerts for SQL error messages that indicate injection attempts
• Track authentication patterns to identify potentially compromised accounts being used for exploitation

How to Mitigate CVE-2026-33025

Immediate Actions Required

• Upgrade AVideo to version 8.0 or later, which contains the security fix
• Apply WAF rules to block POST requests where any sort[*] key contains characters outside [A-Za-z0-9_]
• Restrict access to the queue view (queue.json.php, index.php) to trusted IP ranges only as an interim measure

Patch Information

The vulnerability has been fixed in AVideo version 8.0. The fix replaces the ineffective real_escape_string() sanitization with proper identifier validation using preg_replace() to allow only alphanumeric characters and underscores. Additionally, the sort direction value is now validated against a strict whitelist containing only asc and desc values.

Review the GitHub Security Advisory GHSA-5qvj-5h75-27pj for complete details on the vulnerability and fix.

Workarounds

• Implement a WAF rule to validate that all sort[*] parameter keys match the pattern ^[A-Za-z0-9_]+$
• Restrict network access to affected endpoints (queue.json.php, index.php) to trusted IP addresses or internal networks only
• If possible, disable the sorting functionality entirely until the patch can be applied

// Patched code - proper identifier sanitization
if (!empty($_POST['sort'])) {
    $orderBy = [];
    foreach ($_POST['sort'] as $key => $value) {
        // Prevent SQL injection: allow only alphanumeric characters and underscores in column names
        $key = preg_replace('/[^a-zA-Z0-9_]/', '', $key);
        // Restrict sort direction to a strict whitelist
        $value = strtolower(trim($value));
        if (!in_array($value, ['asc', 'desc'])) {
            $value = 'asc';
        }
        if (!empty($key)) {
            $orderBy[] = " `{$key}` {$value} ";
        }
    }
    $sql .= " ORDER BY " . implode(",", $orderBy);
}

Source: GitHub Commit Changes