Executive Summary

CVE-2026-33651 is a high-severity blind SQL injection vulnerability in the WWBN AVideo platform, specifically in the Live Schedule Reminder feature. The vulnerability occurs because the `live_schedule_id` parameter from the `remindMe.json.php` endpoint is passed through multiple functions without proper sanitization and is ultimately concatenated directly into a SQL LIKE clause in the `Scheduler_commands::getAllActiveOrToRepeat()` method.

Although some intermediate functions apply `intval()` to local copies of the parameter, the original variable remains unsanitized and tainted. This allows any authenticated user to perform time-based blind SQL injection attacks by injecting malicious SQL code into the `live_schedule_id` parameter.

Exploitation can include delaying responses to confirm injection and extracting sensitive database information such as admin credentials, user personal data, API keys, and session tokens. The vulnerability has a CVSS v3.1 score of 8.1, indicating high severity.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including full database read access by an attacker, allowing extraction of sensitive information such as admin credentials, user emails, passwords, API keys, and session tokens.

There is also potential for data modification if the database user has sufficient privileges, enabling attackers to insert, update, or delete data.

Additionally, attackers can perform account takeover by extracting admin password hashes or session tokens.

The attack complexity is low, requiring only authenticated user privileges and no user interaction beyond authentication.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by observing time delays in responses when sending specially crafted requests to the `remindMe.json.php` endpoint with the `live_schedule_id` parameter.'}, {'type': 'paragraph', 'content': 'For example, an authenticated user can test for time-based blind SQL injection by sending a request with `live_schedule_id=1" AND SLEEP(5) -- ` and checking if the response is delayed by approximately 5 seconds.'}, {'type': 'paragraph', 'content': 'A sample command using curl to test this could be:'}, {'type': 'list_item', 'content': 'curl -b cookies.txt "https://your-avideo-instance/plugin/Live/remindMe.json.php?live_schedule_id=1%22%20AND%20SLEEP(5)%20--%20"'}, {'type': 'paragraph', 'content': 'Where `-b cookies.txt` contains authentication cookies for an authenticated user session.'}, {'type': 'paragraph', 'content': 'If the response time is significantly increased (e.g., delayed by 5 seconds), it indicates the presence of the SQL injection vulnerability.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Apply input sanitization by casting the `live_schedule_id` parameter to an integer at the entry point in `plugin/Live/remindMe.json.php` using `intval()`.
• Refactor the vulnerable SQL query in `Scheduler_commands::getAllActiveOrToRepeat()` to use parameterized queries with prepared statements instead of directly concatenating user input.
• Ensure that the patch from commit 75d45780728294ededa1e3f842f95295d3e7d144 is applied, which implements both input sanitization and SQL query parameterization.

These steps prevent SQL injection by ensuring that user input is properly sanitized and safely incorporated into SQL queries.

Useful 0 Not Useful 0