A video-sharing platform before version 8.0 is vulnerable to authenticated SQL injection. The getSqlFromPost() method uses $_POST['sort'] array keys directly as SQL column identifiers in an ORDER BY clause without proper validation. Although real_escape_string was applied, it only protects string contexts and does not escape identifiers, allowing an attacker with a valid session to inject arbitrary SQL code. This can lead to unauthorized data disclosure, modification, or elevation of privileges. The flaw maps to CWE‑89, a classic SQL injection weakness.

The affected product is WWBN’s AVideo‑Encoder. Any installation running a version earlier than 8.0 of the platform is susceptible. No other vendor or product is listed; the vulnerability is tied solely to the AVideo code base prior to the 8.0 release.

The CVSS score is 8.6, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not referenced in the CISA KEV catalog. Exploitation requires an authenticated user to craft a POST request targeting the sort parameter, which is then reflected in the ORDER BY clause, enabling arbitrary SQL commands. Because the attack vector is limited to authenticated sessions, the overall risk is mitigated by the need for valid credentials, but once obtained, the impact can be significant.