Executive Summary

CVE-2026-33352 is a critical unauthenticated SQL injection vulnerability in the WWBN AVideo platform versions prior to 26.0. It exists in the getAllCategories() method in objects/category.php, specifically involving the doNotShowCats request parameter.

The vulnerability arises because the doNotShowCats parameter is only sanitized by removing single-quote characters, but this is insufficient since backslash characters are not removed or escaped. MySQL treats backslashes as escape characters, allowing attackers to bypass the single-quote stripping and manipulate SQL query boundaries.

This improper sanitization combined with direct concatenation of the parameter into SQL queries without parameterization allows attackers to inject arbitrary SQL code. For example, an attacker can craft input that causes the SQL query to always evaluate to true or extract sensitive data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including:

• Confidentiality: Attackers can gain full read access to the database, including sensitive information such as usernames, password hashes, emails, private video metadata, API secrets, and plugin configurations.
• Integrity: Attackers can modify or delete any data, for example by elevating privileges through updating user roles.
• Availability: Attackers can disrupt service by dropping tables or corrupting data.
• Potential Remote Code Execution: If the MySQL server permits SELECT ... INTO OUTFILE, attackers could write PHP web shells to the server’s document root, leading to full system compromise.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the `doNotShowCats` request parameter in the `getAllCategories()` method of the WWBN AVideo platform for SQL injection weaknesses. Specifically, sending crafted inputs that use backslash escape sequences to bypass the single-quote stripping can reveal the vulnerability.'}, {'type': 'paragraph', 'content': 'A sample test input to detect the vulnerability could be: doNotShowCats[0]=\\&doNotShowCats[1]=) OR 1=1)--'}, {'type': 'paragraph', 'content': 'You can use tools like curl or Burp Suite to send HTTP requests with this parameter and observe if the response indicates SQL injection, such as unexpected data exposure or error messages.'}, {'type': 'list_item', 'content': 'Example curl command to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -G \'http://target-site/objects/category.php\' --data-urlencode "doNotShowCats[0]=\\\\" --data-urlencode "doNotShowCats[1]=) OR 1=1)--"'}, {'type': 'paragraph', 'content': 'If the response returns data that should have been filtered or shows SQL errors, it indicates the presence of the vulnerability.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation involves properly escaping the `doNotShowCats` input parameter before it is used in SQL queries.'}, {'type': 'paragraph', 'content': 'Specifically, apply the MySQLi `real_escape_string()` function to each element of the `doNotShowCats` array to neutralize special characters including backslashes.'}, {'type': 'paragraph', 'content': 'A stronger and recommended fix is to replace the vulnerable code with parameterized queries using placeholders and binding parameters securely, which prevents SQL injection by design.'}, {'type': 'list_item', 'content': 'Convert `doNotShowCats` to an array if it is not already.'}, {'type': 'list_item', 'content': "Escape each category name using `$global['mysqli']->real_escape_string($value)`."}, {'type': 'list_item', 'content': 'Use parameterized queries with placeholders and bind parameters instead of concatenating strings directly.'}, {'type': 'paragraph', 'content': 'Upgrading to WWBN AVideo version 26.0 or later, which contains the patch for this vulnerability, is strongly advised.'}] [1, 2]

Useful 0 Not Useful 0