arkmarta

Metasploit · Author

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

Metasploit

AVideo Unauthenticated SQL Injection Credential Dump

Metasploit auxiliary PoCby Valentin Lobstein <chocapikk@leakix.net>Added to Metasploit 2026-03-06ExploitCVE-2026-285011 file

auxiliary_gather/avideo_catname_sqli · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit auxiliary module that exploits CVE-2026-28501, an unauthenticated time-based blind SQL injection in AVideo <= 22.0, to dump usernames and password hashes from the users table.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary module that exploits CVE-2026-28501 to dump user credentials via time-based blind SQL injection. All behavior is consistent with the stated purpose: it sends a JSON payload with a SQL injection to a vulnerable endpoint, extracts usernames and password hashes, stores them as loot, and reports credentials and vulnerability information. No concealed, deceptive, or operator-directed harmful behavior is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagesruby
Target softwareAVideo
Attack typessql injectioncredential dumping
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively exploits the SQL injection vulnerability by sending crafted payloads to extract data from the database, which constitutes exploitation rather than mere scanning or detection.

modules/auxiliary/gather/avideo_catname_sqli.rb:79-86modules/auxiliary/gather/avideo_catname_sqli.rb:132-141

Requirements

  • Target running AVideo <= 22.0 with vulnerable objects/videos.json.php endpointmodules/auxiliary/gather/avideo_catname_sqli.rb:18-19

Observed behavior

  • Sends a JSON POST request with a malicious catName parameter containing a time-based blind SQL injection payload using BENCHMARK()modules/auxiliary/gather/avideo_catname_sqli.rb:133-141
  • Dumps usernames and password hashes from the users table via blind SQL injectionmodules/auxiliary/gather/avideo_catname_sqli.rb:82-86
  • Stores extracted credentials as loot and creates credential objects in the Metasploit databasemodules/auxiliary/gather/avideo_catname_sqli.rb:99-119
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Extraction
Payload withheldThis is the declared purpose of the module and is performed using the Metasploit SQLi library's dump_table_fields method.modules/auxiliary/gather/avideo_catname_sqli.rb:82-86
Data Exfiltration
Payload withheldStandard Metasploit reporting behavior for credential-gathering modules; no external exfiltration is performed.modules/auxiliary/gather/avideo_catname_sqli.rb:99-119
Vulnerability Exploitation
Payload withheldThe payload uses BENCHMARK() to induce delays for data extraction, matching the described technique for bypassing prepared statement restrictions.modules/auxiliary/gather/avideo_catname_sqli.rb:133-141
Review boundaries

What the analysis did not establish

  • Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include runtime execution output or confirmation of successful exploitation.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and any external payloads are not included in the evidence.
  • The review does not assess the safety or correctness of the SQL injection technique itself, only the absence of backdoor behavior in the module code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Metasploit

AVideo Encoder getImage.php Unauthenticated Command Injection

Metasploit exploitby Valentin Lobstein <chocapikk@leakix.net>Added to Metasploit 2026-03-06ExploitCVE-2026-290581 file

exploit_linux/http/avideo_encoder_getimage_cmd_injection · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit module that exploits CVE-2026-29058, an unauthenticated OS command injection in AVideo Encoder's getImage.php endpoint. It sends a crafted GET request with a base64-encoded URL containing a command substitution payload to achieve arbitrary command execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard exploit for CVE-2026-29058, an OS command injection vulnerability in AVideo Encoder. The module sends a crafted HTTP GET request with a command injection payload to the target's getImage.php endpoint. No backdoor, deceptive payload, or concealed operator-directed harm is present. The module's behavior is consistent with its documented purpose of exploiting the stated vulnerability.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareAVideo Encoder
Attack typesOS command injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a fully functional exploit that sends a malicious request to execute arbitrary OS commands on the target. It includes both a check method for vulnerability detection and an exploit method that delivers a payload for command execution.

modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:100-103modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:105-110

Requirements

  • Target must be running a vulnerable version of AVideo Encoder (< 7.0) with the getImage.php endpoint accessible.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:18-19

Observed behavior

  • Sends a GET request to payload withheld with a base64Url parameter containing a base64-encoded URL and an injected shell command.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:105-110
  • The check method confirms vulnerability by measuring response time after injecting sleep commands.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:75-98
  • The exploit method sends the Metasploit payload encoded as a command, replacing spaces with ${IFS}.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:100-103
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Injection Payload
Payload withheldThe exploit method substitutes spaces in the Metasploit payload with ${IFS} to avoid shell parsing issues, a standard technique for command injection exploits.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:102
Exploit Target Endpoint
Payload withheldThe module targets the vulnerable endpoint described in the CVE, sending a crafted base64Url parameter containing a command injection.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:107-109
Review boundaries

What the analysis did not establish

  • Analysis is based on module source code and metadata only; framework mixins, libraries, and external payloads are not expanded.
  • No network traffic or runtime behavior was observed; classification relies solely on static code analysis.
  • Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
  • The actual payload executed on the target is determined by the Metasploit framework at runtime and is not included in the reviewed evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.