automatic module_metadata_base.json update

Author: jenkins-metasploit

db/modules_metadata_base.json

@@ -21071,6 +21071,61 @@
     "needs_cleanup": false,
     "actions": []
   },
+  "auxiliary_gather/avideo_catname_sqli": {
+    "name": "AVideo Unauthenticated SQL Injection Credential Dump",
+    "fullname": "auxiliary/gather/avideo_catname_sqli",
+    "aliases": [],
+    "rank": 300,
+    "disclosure_date": "2026-03-05",
+    "type": "auxiliary",
+    "author": [
+      "arkmarta",
+      "Valentin Lobstein <chocapikk@leakix.net>"
+    ],
+    "description": "AVideo <= 22.0 is vulnerable to unauthenticated SQL injection via the\n          catName parameter in objects/videos.json.php (CVE-2026-28501).\n\n          The security filter in security.php sanitizes GET/POST parameters but\n          does not cover JSON request bodies. Since videos.json.php parses JSON\n          input and merges it into $_REQUEST after the filter runs, a catName\n          value sent as JSON bypasses sanitization entirely and reaches\n          getCatSQL() unsanitized.\n\n          This module uses time-based blind injection with BENCHMARK() to dump\n          usernames and password hashes. SLEEP() is blocked by the sqlDAL\n          prepared statement layer, but BENCHMARK(N*(condition), SHA1(x)) works\n          because the condition is evaluated as a multiplier on the iteration\n          count, avoiding the subquery restrictions imposed by prepare().\n\n          Fixed in 24.0 (no 23.0 release exists).",
+    "references": [
+      "CVE-2026-28501",
+      "GHSA-pv87-r9qf-x56p"
+    ],
+    "platform": "",
+    "arch": "",
+    "rport": 80,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": null,
+    "mod_time": "2026-03-23 01:52:06 +0000",
+    "path": "/modules/auxiliary/gather/avideo_catname_sqli.rb",
+    "is_install_path": true,
+    "ref_name": "gather/avideo_catname_sqli",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "SideEffects": [
+        "ioc-in-logs"
+      ],
+      "Reliability": []
+    },
+    "session_types": false,
+    "needs_cleanup": false,
+    "actions": []
+  },
   "auxiliary_gather/avtech744_dvr_accounts": {
     "name": "AVTECH 744 DVR Account Information Retrieval",
     "fullname": "auxiliary/gather/avtech744_dvr_accounts",