CVE-2026-28501: 
PHP vulnerability analysis and mitigation

CVE-2026-28501 is an unauthenticated SQL Injection vulnerability in WWBN AVideo, an open source video platform, affecting all versions prior to 24.0. The flaw exists in the objects/videos.json.php and objects/video.php components, where the catName parameter is not properly sanitized when supplied via a JSON-formatted POST request body. It was published on March 6, 2026, with a patch released in version 24.0. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). AVideo applies global security checks and input sanitization before JSON POST body parameters are parsed; however, JSON input is subsequently parsed and merged into PHP's $_REQUEST superglobal after those checks have already executed, allowing malicious SQL payloads in the catName parameter to bypass all sanitization. The fix applied $global['mysqli']->real_escape_string() to the catName value and other unsanitized inputs in objects/video.php, objects/Object.php, objects/bootGrid.php, and related plugin files. No authentication is required to trigger the vulnerability — an attacker only needs network access to the target AVideo instance (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL queries against the underlying database, enabling full database exfiltration including administrator usernames, password hashes, session identifiers, and user records. Attackers can also modify or delete database records, potentially escalate privileges by cracking extracted password hashes offline, and chain this vulnerability with authenticated attack paths to achieve full system compromise. Depending on database server configuration (e.g., FILE privileges or xp_cmdshell), remote code execution may also be possible (GitHub Advisory).

A Metasploit auxiliary module (modules/auxiliary/gather/avideo_catname_sqli.rb) was added to the Metasploit Framework on April 9, 2026, providing a weaponized, publicly available exploit (Metasploit Module). The Rapid7 team highlighted this module in their April 17, 2026 Metasploit wrap-up (Rapid7 Blog). As of the latest available intelligence, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.029% (0.000290), indicating a currently low but non-negligible probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances (versions < 24.0) using search engines like Shodan or Censys, or by fingerprinting the AVideo web interface.
2. Identify vulnerable endpoints: Target the endpoints objects/videos.json.php or objects/video.php, which accept JSON-formatted POST request bodies and process the catName parameter.
3. Craft malicious JSON payload: Construct a JSON POST body containing a SQL injection payload in the catName field, e.g., {"catName": ["' UNION SELECT username,password,3,4,5,6,7,8,9,10 FROM users-- -"]}. Because JSON is parsed into $_REQUEST after global sanitization checks, the payload is not filtered.
4. Send the request: Submit the crafted POST request to the target endpoint. The Metasploit module auxiliary/gather/avideo_catname_sqli automates this step.
5. Extract data: Parse the SQL query results returned in the HTTP response to extract administrator credentials, session tokens, and other sensitive database records.
6. Escalate access: Use extracted password hashes for offline cracking, or leverage obtained session tokens to authenticate as an administrator and chain with further vulnerabilities for full system compromise (GitHub Advisory, Metasploit Module).

• Network: Unusual HTTP POST requests to /objects/videos.json.php or /objects/video.php with a Content-Type: application/json header containing SQL metacharacters (e.g., single quotes, UNION, SELECT, --) in the catName field; unexpected outbound database query traffic or connections from the web server.
• Logs: Web server access logs showing POST requests to the above endpoints from unexpected or anonymous sources; database query logs containing anomalous SQL patterns such as UNION SELECT, information_schema, or multi-row injection syntax originating from the application.
• File System: Unexpected new files (e.g., web shells) written to the AVideo installation directory if exploitation is chained with file-write database privileges.
• Process: Unusual child processes spawned by the web server process (e.g., bash, sh, curl, wget) if the database is configured with OS command execution capabilities (GitHub Advisory).

The vendor has released a patch in AVideo version 24.0, which applies mysqli::real_escape_string() to the catName parameter and other unsanitized inputs across multiple files. All users should upgrade to version 24.0 or later immediately (AVideo Release, Patch Commit). The GitHub security advisory states there is no reliable workaround short of upgrading. For environments where immediate patching is not feasible, implement network-level access controls to restrict POST requests to the affected endpoints, monitor database query logs for suspicious SQL patterns, and consider placing the application behind a web application firewall (WAF) with SQL injection detection rules (GitHub Advisory).

The vulnerability received coverage from security news outlets including SecurityOnline.info and TheHackerWire, which published articles on the unauthenticated SQL injection flaw shortly after disclosure (SecurityOnline, TheHackerWire). The addition of a Metasploit module was noted in Rapid7's official weekly wrap-up blog post on April 17, 2026, signaling broader community awareness (Rapid7 Blog). Social media discussion was observed on Bluesky and Mastodon, with security researchers sharing the advisory and Metasploit module details.