GHSA-mcj5-6qr4-95fj AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)
SummaryAn unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace("'", '', ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application's global input filters in `objects/security.php`.Affected Component**File:** `objects/category.php`, lines 386-394, inside method `getAllCategories()`Root Cause**Incomplete sanitization:** The only defense is `str_replace("'", '', $value)`, which strips single-quote characters. It does **not** strip backslashes (`\`).**No global filter coverage:** The `doNotShowCats` parameter is absent from every filter list in `objects/security.php` (`$securityFilter`, `$securityFilterInt`, `$securityRemoveSingleQuotes`, `$securityRemoveNonChars`, `$securityRemoveNonCharsStrict`, `$filterURL`, and the `_id` suffix pattern).**Direct string concatenation into SQL:** The filtered values are concatenated into the SQL query via `implode()` instead of using parameterized queries.ExploitationMySQL, by default, treats the backslash (`\`) as an escape character inside string literals (unless `NO_BACKSLASH_ESCAPES` SQL mode is enabled, which is uncommon). This allows a backslash in one array element to escape the closing single-quote that `implode()` adds, shifting the string boundary and turning the next array element into executable SQL.**Step-by-step:**The attacker sends:After `str_replace("'", '', ...)`, values are unchanged (no single quotes to strip):Element 0: `\`Element 1: `) OR 1=1)-- -`After `implode("', '", ...)`, the concatenated string is:The full SQL becomes:MySQL parses this as:`'\'` — the `\` escapes the next `'`, making it a literal quote character inside the string. The string continues.`, '` — the comma and space are part of the string. The next `'` (which was the opening quote of element 1) **closes** the string.String value = `', ` (three characters: quote, comma, space)`) OR 1=1)` — executable SQL. The first `)` closes `NOT IN (`, the second `)` closes the outer `AND (`.`-- -` — SQL comment, discards the remainder `') )`Effective SQL:This always evaluates to `TRUE`.**For data extraction (UNION-based):**Produces:This appends a UNION query that extracts usernames and password hashes from the `users` table. The attacker must match the column count of the original `SELECT` (determinable through iterative probing).Impact**Confidentiality:** Full read access to the entire database, including user credentials, emails, private video metadata, API secrets, and plugin configuration.**Integrity:** Ability to modify or delete any data in the database via stacked queries or subqueries (e.g., `UPDATE users SET isAdmin=1`).**Availability:** Ability to drop tables or corrupt data.**Potential RCE:** On MySQL configurations that allow `SELECT ... INTO OUTFILE`, the attacker could write a PHP web shell to the server's document root.Suggested FixReplace the string concatenation with parameterized queries:Alternatively, use `$global['mysqli']->real_escape_string()` on each value as a minimum fix, though parameterized queries are strongly preferred.
CVSS v3.1 score: 9.8