CVE-2026-33485
Unauthenticated Blind SQL Injection in WWBN AVideo RTMP Plugin
Publication date: 2026-03-23
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 26.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-33485 is a high-severity unauthenticated blind SQL injection vulnerability in the WWBN AVideo platform, specifically in the RTMP on_publish callback located at plugin/Live/on_publish.php. The vulnerability arises because the stream key parameter ($_POST['name']) is directly inserted into SQL queries without proper escaping or parameterization."}, {'type': 'paragraph', 'content': 'This allows an attacker to perform time-based blind SQL injection attacks by sending specially crafted requests to the vulnerable endpoint, which requires no authentication or IP restrictions. The attacker can extract sensitive data from the database, including user password hashes, email addresses, API keys, session tokens, and site configuration secrets.'}, {'type': 'paragraph', 'content': 'The vulnerability exists in two main functions: LiveTransmitionHistory::getLatest() and LiveTransmition::keyExists(), where the stream key is interpolated directly into SQL queries without parameterized binding. The only sanitization applied is insufficient regex filtering that does not prevent SQL injection.'}] [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including full database compromise by an unauthenticated remote attacker.
- Extraction of all database contents such as user password hashes (bcrypt), email addresses, personal information, API keys, session tokens, and live stream passwords.
- Ability to authenticate as any user by exploiting how the system compares raw stored password hashes, enabling user impersonation and unauthorized streaming.
- Enumeration of the database schema via information_schema queries, facilitating further exploitation.
Overall, the vulnerability allows an attacker to compromise confidentiality and impersonate users without any privileges or user interaction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending specially crafted POST requests to the RTMP on_publish callback endpoint at plugin/Live/on_publish.php, specifically targeting the unauthenticated $_POST['name'] parameter (stream key)."}, {'type': 'paragraph', 'content': "A common detection method is to test for time-based blind SQL injection by injecting payloads that cause a delay in the server response, such as: name=' OR (SELECT SLEEP(5)) #"}, {'type': 'paragraph', 'content': 'If the server response is delayed by approximately 5 seconds, it confirms the presence of the SQL injection vulnerability.'}, {'type': 'paragraph', 'content': 'Example command using curl to test the vulnerability:'}, {'type': 'list_item', 'content': 'curl -X POST -d "name=\' OR (SELECT SLEEP(5)) #" http://<target>/plugin/Live/on_publish.php'}, {'type': 'paragraph', 'content': 'Monitoring network traffic for unauthenticated POST requests to this endpoint with suspicious payloads can also help detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the patch that replaces unsafe string interpolation in SQL queries with parameterized queries using bound parameters.
Specifically, update the affected methods in the LiveTransmition and LiveTransmitionHistory components to use parameterized queries as demonstrated in the official fix.
If patching is not immediately possible, consider restricting access to the vulnerable endpoint (plugin/Live/on_publish.php) by implementing IP allowlisting, authentication, or firewall rules to block unauthenticated requests.
Monitor logs for suspicious activity targeting the on_publish.php endpoint and consider temporarily disabling RTMP streaming if feasible.