WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
概要
WWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components. The application fails to properly sanitize the catName parameter when it is supplied via a JSON-formatted POST request body. Because JSON input is parsed and merged into $_REQUEST after global security checks are executed, the payload bypasses the existing sanitization mechanisms. This issue has been patched in version 24.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com