Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-33485 is a high-severity unauthenticated blind SQL injection vulnerability in the WWBN AVideo platform, specifically in the RTMP on_publish callback located at plugin/Live/on_publish.php. The vulnerability arises because the stream key parameter ($_POST['name']) is directly inserted into SQL queries without proper escaping or parameterization."}, {'type': 'paragraph', 'content': 'This allows an attacker to perform time-based blind SQL injection attacks by sending specially crafted requests to the vulnerable endpoint, which requires no authentication or IP restrictions. The attacker can extract sensitive data from the database, including user password hashes, email addresses, API keys, session tokens, and site configuration secrets.'}, {'type': 'paragraph', 'content': 'The vulnerability exists in two main functions: LiveTransmitionHistory::getLatest() and LiveTransmition::keyExists(), where the stream key is interpolated directly into SQL queries without parameterized binding. The only sanitization applied is insufficient regex filtering that does not prevent SQL injection.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including full database compromise by an unauthenticated remote attacker.

• Extraction of all database contents such as user password hashes (bcrypt), email addresses, personal information, API keys, session tokens, and live stream passwords.
• Ability to authenticate as any user by exploiting how the system compares raw stored password hashes, enabling user impersonation and unauthorized streaming.
• Enumeration of the database schema via information_schema queries, facilitating further exploitation.

Overall, the vulnerability allows an attacker to compromise confidentiality and impersonate users without any privileges or user interaction.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending specially crafted POST requests to the RTMP on_publish callback endpoint at plugin/Live/on_publish.php, specifically targeting the unauthenticated $_POST['name'] parameter (stream key)."}, {'type': 'paragraph', 'content': "A common detection method is to test for time-based blind SQL injection by injecting payloads that cause a delay in the server response, such as: name=' OR (SELECT SLEEP(5)) #"}, {'type': 'paragraph', 'content': 'If the server response is delayed by approximately 5 seconds, it confirms the presence of the SQL injection vulnerability.'}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -X POST -d "name=\' OR (SELECT SLEEP(5)) #" http://<target>/plugin/Live/on_publish.php'}, {'type': 'paragraph', 'content': 'Monitoring network traffic for unauthenticated POST requests to this endpoint with suspicious payloads can also help detect exploitation attempts.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the patch that replaces unsafe string interpolation in SQL queries with parameterized queries using bound parameters.

Specifically, update the affected methods in the LiveTransmition and LiveTransmitionHistory components to use parameterized queries as demonstrated in the official fix.

If patching is not immediately possible, consider restricting access to the vulnerable endpoint (plugin/Live/on_publish.php) by implementing IP allowlisting, authentication, or firewall rules to block unauthenticated requests.

Monitor logs for suspicious activity targeting the on_publish.php endpoint and consider temporarily disabling RTMP streaming if feasible.

Useful 0 Not Useful 0