{"id":"CVE-2026-61564","published":"2026-10-28T22:17:15.750","lastModified":"2026-10-28T22:17:15.750","description":"AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string literals without escaping. An attacker can terminate a literal and inject PHP that executes as the web-server user when the generated, directly requestable file is loaded. Exploitation requires `videos/configuration.php` to be absent, as on every fresh deployment or after the file is removed or moved; an existing file blocks this endpoint. The supplied `systemRootPath` must contain index.php and a connection using `databaseHost`, `databaseUser`, and `databasePass` must succeed, but the attacker can point those parameters to their own database server and needs no target credentials. The write location is also derived from `systemRootPath` without a base-directory constraint. This permits arbitrary command execution, reading and overwriting files owned by the web-server user, persistent PHP code, and control over stored database connection settings. The endpoint additionally interpolates request values into streamer and configuration INSERT statements, creating a secondary SQL-injection sink. This issue is fixed in version 8.1.0.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411","tags":[]},{"url":"https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","tags":[]},{"url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992","tags":[]}],"exploitRefs":[{"url":"https://github.com/WWBN/AVideo-Encoder/commit/0faaddebd11c087885d25a7e0513745465cad411","tags":[]},{"url":"https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0","tags":[]},{"url":"https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-xrj3-cqm8-r992","tags":[]}],"hasPoc":true,"ai":{"summary":"The install/checkConfiguration.php endpoint in AVideo before 8.1.0 constructs a PHP configuration file by unsafely interpolating unauthenticated user input into single-quoted PHP strings, allowing an attacker to break out of the string and inject arbitrary PHP code that executes on the server when the generated file is loaded.","exploitability":"Exploitation requires a fresh deployment or manually removed/renamed videos/configuration.php, successful database connectivity (which the attacker can control by pointing to their own server), and supply of a systemRootPath containing index.php; no authentication or prior knowledge of target credentials is needed.","blast_radius":"Successful exploitation grants full remote code execution as the web-server user, enabling complete compromise of the host, persistent backdoors via PHP file writes, and manipulation of stored database credentials.","remediation":"Upgrade to AVideo version 8.1.0 or later, which fixes the unsafe string interpolation in the installer endpoint.","detection":"An attacker must first trigger the install/checkConfiguration.php endpoint with malicious parameters; defenders should monitor for HTTP requests to /install/checkConfiguration.php containing suspicious strings like single quotes, semicolons, or PHP tags (e.g., '?>') in parameters such as webSiteRootURL, systemRootPath, databaseHost, databaseUser, or databasePass, especially when videos/configuration.php does not yet exist.","tags":["rce","web","unauthenticated","installer","php-injection"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:40:31.514Z"}}