AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

QFinch assessment

The fixCleanTitle() static method in objects/category.php constructs a SQL SELECT query by directly interpolating both $cleantitle and $id into the query string without using prepared statements or parameterized queries. An attacker who can trigger category creation or renaming with a crafted title value can inject arbitrary SQL.

Potential impact

- Type: SQL Injection (CWE-89) - Severity: High - Authentication required: Admin-level (category management), though the same pattern may be reachable via lower-privilege paths depending on plugin configuration - Impact: Full database read; credentials, private video metadata, user PII accessible via UNION injection - Fix: Replace direct interpolation with parameterized queries — use ? placeholders and pass $cleantitle and (int)$id as bound parameters

Technical context

File: objects/category.php Vulnerable code: Both $cleantitle (a user-supplied category name after slug conversion) and $id (the category ID being edited) are embedded directly into the SQL string. The $cleantitle value derives from user input through the category save workflow — it is the "clean" URL-slug version of whatever category name the user submits. No escaping or parameterization is applied before the value is placed inside single quotes in the query.