CVE-2026-33651 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` through multiple functions without sanitization until it reaches `Scheduler_commands::getAllActiveOrToRepeat()`, which directly concatenates it into a SQL `LIKE` clause. Although intermediate functions (`new Live_schedule()`, `getUsers_idOrCompany()`) apply `intval()` internally, they do so on local copies within `ObjectYPT::getFromDb()`, leaving the original tainted variable unchanged. Any authenticated user can perform time-based blind SQL injection to extract arbitrary database contents. Commit 75d45780728294ededa1e3f842f95295d3e7d144 contains a patch.
A blind SQL injection vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the 'remindMe.json.php' endpoint, where the 'live_schedule_id' parameter is passed through several functions without proper sanitization. This unsanitized data eventually reaches 'Scheduler_commands::getAllActiveOrToRepeat()', which concatenates it directly into a SQL 'LIKE' clause. Although some intermediate functions apply 'intval()' to local copies of the variable, the original, tainted input remains unchanged. As a result, any authenticated user can exploit this vulnerability to perform time-based blind SQL injection, allowing for the extraction of arbitrary database contents.
The vulnerability has been patched in commit 75d45780728294ededa1e3f842f95295d3e7d144. Users are advised to update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/75d45780728294ededa1e3f842f95295d3e7d144 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-pvw4-p2jm-chjm | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |