AVideo SQL 注入漏洞 (CVE-2026-34374) 影响版本

AVideo开源视频平台中的CVE-2026-34374漏洞存在于Liveschedule::keyExists()方法中。受影响的版本包括26.0及更早版本。问题在于没有正确参数化地构建SQL查询。具体来说，流密钥被直接插入到查询字符串中，从而允许SQL注入。虽然调用函数LiveTransmition::keyExists()对其自身的查询使用了参数化查询，但到Liveschedule::keyExists()的备用路径没有这样做。攻击者可以利用此漏洞在底层数据库上执行任意SQL代码，从而可能损害数据完整性和保密性。CVSS评分已评为9.1，表明存在严重风险。缺乏可用的修复程序加剧了这种情况，需要立即关注。

Organizations utilizing AVideo version 26.0 or earlier, particularly those hosting the platform on shared hosting environments or with limited security controls, are at significant risk. Deployments relying on legacy configurations or custom integrations that interact with the Live_schedule::keyExists() method are also particularly vulnerable.

• php: Examine application logs for SQL errors or unusual database activity related to the Live_schedule::keyExists() method. Use a code scanner to identify instances of string concatenation used to build SQL queries. • generic web: Monitor access logs for requests to endpoints associated with live scheduling functionality. Look for unusual characters or patterns in the request parameters that might indicate an injection attempt. • database (mysql): Use mysql -e 'SHOW PROCESSLIST;' to monitor active database connections and identify any suspicious queries being executed. Review slow query logs for queries that take an unusually long time to execute, which could indicate an injection attack.

1. 2026-03-27Disclosure

   disclosure

1. 已保留2026-03-27
2. 发布日期2026-03-27
3. EPSS 更新日期2026-04-04

由于AVideo团队没有提供官方修复程序，因此即时缓解措施是避免使用26.0之前的AVideo版本。如果无法升级，强烈建议在数据库环境中实施额外的安全措施。这可能包括限制AVideo应用程序的数据库访问权限、实施数据库防火墙以限制网络流量以及监控数据库活动以查找可疑模式。此外，应审查Live_schedule::keyExists()的源代码，并对SQL查询应用适当的参数化。使用AVideo的用户应联系开发团队请求修复程序，并随时了解任何安全更新。