Executive brief
All in One Video Downloader, a script used to create video downloading websites, contains a security flaw in its administrative interface. An attacker can exploit this to run unauthorized database commands without needing a password. This could lead to the theft of sensitive information, including user credentials and database configuration details.
Technical details
An SQL injection vulnerability exists in All in One Video Downloader version 1.2 due to improper neutralization of the 'id' parameter within the administrative 'page-edit' view. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests containing UNION-based SQL payloads. Successful exploitation allows the attacker to bypass authentication and extract sensitive information from the backend database, such as database version, names, and user credentials. The vulnerability is triggered via the URL path /admin/?view=page-edit&id=.
Affected products
- Niche Office All in One Video Downloader 1.2
Timeline
- 2019-01-01: disclosed: Initial discovery and exploit published by Deyaa Muhammad
- 2026-06-04: advisory: CVE-2019-25726 published by NVD/VulnCheck