CVE-2026-84208 Overview
CVE-2026-84208 is an unauthenticated SQL injection vulnerability in AVideo through version 29.0. The flaw resides in the User_Location plugin, specifically in the regions.json.php and cities.json.php endpoints. The country and region GET parameters flow directly into SQL queries without escaping or prepared statement binding. Unauthenticated remote attackers can execute UNION-based SQL injection to read arbitrary database contents, including password hashes and other sensitive records. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Unauthenticated attackers can extract credentials and sensitive data from the AVideo database over the network without user interaction.
Affected Products
- WWBN AVideo through version 29.0
- AVideo User_Location plugin — regions.json.php endpoint
- AVideo User_Location plugin — cities.json.php endpoint
Discovery Timeline
- 2026-09-01 - CVE-2026-84208 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84208
Vulnerability Analysis
The User_Location plugin exposes two JSON endpoints, regions.json.php and cities.json.php, that accept user-supplied GET parameters. The country parameter in regions.json.php and both country and region parameters in cities.json.php are concatenated into SQL query strings. The application performs no input sanitization, escaping, or parameter binding before query execution. Attackers can inject arbitrary SQL syntax, including UNION SELECT clauses, to exfiltrate data from any table the database user can read. Because the endpoints require no authentication, exploitation is trivial and does not depend on prior access to the platform.
Root Cause
The root cause is the direct interpolation of untrusted HTTP request parameters into SQL statements. The affected code paths do not use prepared statements or parameterized queries provided by the database abstraction layer. This allows attacker-controlled input to alter the structure of the SQL query rather than being treated strictly as data.
Attack Vector
An attacker sends a crafted HTTP GET request to the vulnerable JSON endpoint with malicious SQL payloads placed in the country or region parameter. The response returns query results in JSON form, enabling data extraction through UNION-based techniques. The attacker requires no credentials, no user interaction, and only network reachability to the AVideo instance.
Refer to the VulnCheck SQL Injection Advisory and the GitHub Security Advisory for technical write-ups and payload examples.
Detection Methods for CVE-2026-84208
Indicators of Compromise
- HTTP GET requests to /plugin/User_Location/regions.json.php or /plugin/User_Location/cities.json.php containing SQL keywords such as UNION, SELECT, SLEEP, or encoded variants in the country or region parameter.
- Unexpected outbound traffic or large JSON responses from these endpoints to unfamiliar client IP addresses.
- Web server access logs showing repeated requests to the User_Location plugin endpoints from a single source with varying query strings.
Detection Strategies
- Deploy web application firewall (WAF) rules that flag SQL injection signatures targeting the country and region GET parameters on User_Location plugin URLs.
- Enable database query logging and alert on UNION SELECT statements originating from the AVideo application user.
- Correlate access logs with database audit logs to identify JSON endpoint requests that produce anomalous SELECT patterns.
Monitoring Recommendations
- Monitor the users table and any table containing password hashes for read activity outside normal application workflows.
- Track HTTP 200 responses of unusually large size from regions.json.php and cities.json.php.
- Alert on repeated 4xx/5xx errors from the plugin endpoints, which often indicate injection probing.
How to Mitigate CVE-2026-84208
Immediate Actions Required
- Upgrade AVideo to a fixed release beyond version 29.0 as published in the GitHub Security Advisory.
- Disable the User_Location plugin until patches are applied if an immediate upgrade is not feasible.
- Rotate all administrative and user credentials, and invalidate active sessions, because password hashes may already be exposed.
Patch Information
WWBN has published a security advisory for AVideo tracked as GHSA-xj29-cg44-33q6. Administrators should apply the vendor-provided fix that replaces string concatenation with parameterized queries in the User_Location plugin. See the GitHub Security Advisory for exact version guidance.
Workarounds
- Block external access to /plugin/User_Location/regions.json.php and /plugin/User_Location/cities.json.php at the reverse proxy or WAF layer.
- Restrict the database account used by AVideo to the minimum required privileges to limit data reachable through injection.
- Apply virtual patching rules that reject non-numeric or non-alphabetic values in the country and region GET parameters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
