PHP EUVD-2026-13559

Requires authenticated user account on AVideo versions prior to 8.0. Attacker sends POST request with malicious sort[] array keys in getSqlFromPost() method to inject SQL into ORDER BY clause. No victim interaction needed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) indicates this is a network-exploitable vulnerability with low attack complexity requiring only low-privilege authentication, resulting in high confidentiality and integrity impacts to the vulnerable system. The requirement for authentication (PR:L) reduces the attack surface compared to unauthenticated vulnerabilities, but the low complexity means exploitation is straightforward once access is obtained. The vulnerability is limited to components like queue.json.php and index.php that process sort parameters, which may not be universally exposed in all deployments. While the 8.6 CVSS score suggests high severity, the lack of EPSS data, absence from CISA KEV, and the authentication requirement indicate this is not currently being actively exploited at scale. Organizations running AVideo-Encoder should prioritize patching based on whether they have untrusted authenticated users and whether the affected queue functionality is exposed, making this a medium-to-high priority depending on deployment context rather than an emergency patch.

An authenticated attacker with low-privilege credentials logs into an AVideo-Encoder instance and navigates to the queue management interface. The attacker crafts a malicious POST request to queue.json.php containing a specially crafted sort parameter with SQL injection payloads in the array keys, such as sort[malicious_column`;DROP TABLE users;--]=asc. Because the application uses these keys directly as SQL identifiers in an ORDER BY clause without proper validation, the injected SQL commands execute against the database, allowing the attacker to extract sensitive data like user credentials, modify video metadata, or manipulate the application's data integrity with high confidence of success given the low attack complexity.