AVideo Unauthenticated SQL Injection Credential Dump

MetasploitMetasploit auxiliary PoCExploitRubyauxiliary_gather/avideo_catname_sqli

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit auxiliary module that exploits CVE-2026-28501, an unauthenticated time-based blind SQL injection in AVideo <= 22.0, to dump usernames and password hashes from the users table.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary module that exploits CVE-2026-28501 to dump user credentials via time-based blind SQL injection. All behavior is consistent with the stated purpose: it sends a JSON payload with a SQL injection to a vulnerable endpoint, extracts usernames and password hashes, stores them as loot, and reports credentials and vulnerability information. No concealed, deceptive, or operator-directed harmful behavior is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagesruby
Target softwareAVideo
Attack typessql injectioncredential dumping
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively exploits the SQL injection vulnerability by sending crafted payloads to extract data from the database, which constitutes exploitation rather than mere scanning or detection.

modules/auxiliary/gather/avideo_catname_sqli.rb:79-86modules/auxiliary/gather/avideo_catname_sqli.rb:132-141

Requirements

  • Target running AVideo <= 22.0 with vulnerable objects/videos.json.php endpointmodules/auxiliary/gather/avideo_catname_sqli.rb:18-19

Observed behavior

  • Sends a JSON POST request with a malicious catName parameter containing a time-based blind SQL injection payload using BENCHMARK()modules/auxiliary/gather/avideo_catname_sqli.rb:133-141
  • Dumps usernames and password hashes from the users table via blind SQL injectionmodules/auxiliary/gather/avideo_catname_sqli.rb:82-86
  • Stores extracted credentials as loot and creates credential objects in the Metasploit databasemodules/auxiliary/gather/avideo_catname_sqli.rb:99-119
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Extraction
Dumps 'user' and 'password' columns from the 'users' tableThis is the declared purpose of the module and is performed using the Metasploit SQLi library's dump_table_fields method.modules/auxiliary/gather/avideo_catname_sqli.rb:82-86
Data Exfiltration
Stores extracted credentials as loot and reports them to the Metasploit databaseStandard Metasploit reporting behavior for credential-gathering modules; no external exfiltration is performed.modules/auxiliary/gather/avideo_catname_sqli.rb:99-119
Vulnerability Exploitation
Sends a time-based blind SQL injection payload via JSON POST bodyThe payload uses BENCHMARK() to induce delays for data extraction, matching the described technique for bypassing prepared statement restrictions.modules/auxiliary/gather/avideo_catname_sqli.rb:133-141
Review boundaries

What the analysis did not establish

  • Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
  • The evidence does not include runtime execution output or confirmation of successful exploitation.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and any external payloads are not included in the evidence.
  • The review does not assess the safety or correctness of the SQL injection technique itself, only the absence of backdoor behavior in the module code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1