Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61569— AVideo-Encoder: pre-authentication streamer-login SQL injection

Quick assessment

Affected
WWBN AVideo-Encoder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AVideo 是一个视频分享平台。在 8.1.0 版本之前，未经验证的流媒体主播在 处登录时，会将 参数传递给 中的 方法。该参数在未经参数化或转义的情况下，被直接拼接到一个使用单引号的 MariaDB SELECT 查询中。尽管 会过滤掉字面意义上的单引号，但 中的 函数会在执行查询前将实体编码的引号还原，从而绕过过滤。攻击者提供的 必须通过流媒体主播的白名单验证；该白名单在默认情况下若为空则允许所有站点。此外，由攻击者控制的登录响应必须将 或 设置为真值，才能触发 函数。该函数在其额外的白名单检查之前会先调用

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61569

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AVideo-Encoder: pre-authentication streamer-login SQL injection
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/login.json.php` passes the `user` parameter to `Streamer::get` in `objects/Streamer.php`, where it is interpolated into a single-quoted MariaDB SELECT without parameterization or escaping. Although `objects/security.php` strips literal single quotes, `html_entity_decode` in `objects/Login.php` restores entity-encoded quotes before the query. The supplied `siteURL` must pass the streamer allowlist, which allows all sites when empty by default, and an attacker-hosted login response must set `canUpload` or `isAdmin` to reach `Streamer::createIfNotExists`. That function calls `Streamer::get` before its additional allowlist check. UNION results are exposed through `streamers_id`, while failures return the rendered query and MariaDB error. An attacker can read arbitrary encoder database data, including stored upstream streamer credentials, allowlist configuration, and queue records, without encoder credentials. Stacked statements are not permitted by the mysqli driver and the tested database account lacks global FILE privilege, so the demonstrated vector is bounded to reads rather than server-side file writes. Stolen streamer credentials can provide continued upstream access until rotated. This issue is fixed in version 8.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo-Encoder < 8.1.0 -

II. Public POCs for CVE-2026-61569

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61569

请登录查看更多情报信息。

Other References for CVE-2026-61569 (3)

Same Patch Batch · WWBN · 2026-10-28 · 7 CVEs total

CVE-2026-61567 10.0 CRITICAL AVideo-Encoder: unauthenticated command execution through streamer login trust
CVE-2026-61564 10.0 CRITICAL AVideo-Encoder: unauthenticated installer PHP code injection
CVE-2026-61572 8.6 HIGH AVideo-Encoder: unauthenticated full-response server-side request forgery
CVE-2026-61571 7.3 HIGH AVideo-Encoder: missing authentication on control and status endpoints
CVE-2026-61573 6.1 MEDIUM AVideo-Encoder: reflected cross-site scripting in the login interface
CVE-2026-61575 4.7 MEDIUM AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

IV. Related Vulnerabilities

Same product: AVideo-Encoder
Same vendor: WWBN
Same weakness: CWE-89