CVE-2026-33723 Details

A SQL injection vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the Subscribe::save() method within objects/subscribe.php, where the users_id property is directly concatenated into an SQL INSERT query without proper sanitization or parameterized binding. This unsanitized data, originating from the user_id POST parameter in subscribe.json.php and subscribeNotify.json.php, allows authenticated attackers to inject arbitrary SQL. Exploitation of this vulnerability could lead to the extraction of sensitive information from any database table, including password hashes, API keys, and encryption salts.

Users are advised to update to the latest version of WWBN AVideo, where this vulnerability has been patched. For those unable to update, a manual fix can be applied by modifying the Subscribe::save() method to use prepared statements for SQL queries, ensuring proper parameterization and sanitization of user input.