What is the CVSS score of CVE-2026-33025?

CVE-2026-33025 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33025?

AVideo versions before 8.0 contain a SQL injection vulnerability in sort parameter handling that allows authenticated users to manipulate database queries and access or modify sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-33025?

Within 24 hours: Identify all AVideo installations and document current versions. Within 7 days: Upgrade all AVideo deployments to version 8.0 or later. Within 30 days: Conduct database access logs audit for any suspicious sort parameter activity in POST requests to sort-handling endpoints, and validate WAF rules are blocking non-alphanumeric sort parameter values.

PHP CVE-2026-33025

EUVD-2026-13559 HIGH

SQL Injection (CWE-89)

2026-03-20 security-advisories@github.com

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13559

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

HIGH 8.8

DescriptionGitHub Advisory

AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'] array keys are used directly as SQL column identifiers inside an ORDER BY clause. Although real_escape_string() was applied, it only escapes string-context characters (quotes, null bytes) and provides no protection for SQL identifiers - making it entirely ineffective here. This issue has been fixed in version 8.0. To workaround this issue without upgrading, operators can apply a WAF rule to block POST requests where any sort[*] key contains characters outside [A-Za-z0-9_]. Alternatively, restrict access to the queue view (queue.json.php, index.php) to trusted IP ranges only.

AnalysisAI

Unauthenticated SQL injection in AVideo versions before 8.0 allows authenticated attackers to manipulate database queries through unsanitized sort parameters in POST requests, potentially leading to unauthorized data access or modification. The vulnerability stems from improper use of real_escape_string() on SQL identifiers rather than string literals, rendering the escaping mechanism ineffective. Affected organizations should upgrade to version 8.0 or implement WAF rules restricting sort parameter characters to alphanumeric and underscore values.

Technical ContextAI

This vulnerability affects AVideo-Encoder (CPE data indicates cpe:2.3:a:avideo:avideo-encoder versions below 8.0), a PHP-based video encoding and sharing platform. The root cause is CWE-89 (SQL Injection) where the application incorrectly relies on real_escape_string() to sanitize SQL identifiers in an ORDER BY clause. The real_escape_string() function only escapes string-context characters like quotes and null bytes, but provides no protection when user input is used directly as column names or SQL identifiers outside of quoted strings. The vulnerable code path is in the Object.php file's getSqlFromPost() method, which processes the sort parameter from POST requests and constructs dynamic SQL queries. This represents a fundamental misunderstanding of SQL injection prevention, where identifier context requires allowlisting or proper quoting mechanisms rather than string escaping.

RemediationAI

Upgrade AVideo-Encoder to version 8.0 or later, which contains the fix as documented in the GitHub commit at https://github.com/WWBN/AVideo-Encoder/commit/d1c8a17ac88b5e27da9dfb7a230bbaf54aa53124 and detailed in the security advisory at https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-5qvj-5h75-27pj. For environments where immediate upgrading is not feasible, implement a Web Application Firewall (WAF) rule to block POST requests where any sort parameter key contains characters outside the range [A-Za-z0-9_], effectively restricting sort keys to valid SQL identifier characters. As an additional mitigation layer, restrict access to the vulnerable endpoints (queue.json.php and index.php) to trusted IP ranges using network-level access controls or reverse proxy rules, reducing the attack surface to only trusted authenticated users.