AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
Summary
AVideo has SQL Injection via Partial Prepared Statement — videos_id Concatenated Directly into Query
Original description
The description as published by the source.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, in objects/like.php, the getLike() method constructs a SQL query using a prepared statement placeholder (?) for users_id but directly concatenates $this->videos_id into the query string without parameterization. An attacker who can control the videos_id value (via a crafted request) can inject arbitrary SQL, bypassing the partial prepared-statement protection. Commit 0215d3c4f1ee748b8880254967b51784b8ac4080 contains a patch.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com