Avideo CVE-2026-33651

Authenticated user access required. WWBN AVideo versions up to 26.0, specifically the remindMe.json.php endpoint with live_schedule_id parameter. Attacker must be authenticated to exploit time-based blind SQL injection via unsanitized parameter concatenation in SQL LIKE clause.

This vulnerability presents a significant real-world risk despite requiring low-privilege authentication (PR:L). The CVSS score of 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates network-exploitable attacks with low complexity requiring only basic user credentials. The high confidentiality and integrity impact means attackers can both steal and potentially modify database contents. While no EPSS score or KEV status is provided in the available data, the availability of a GitHub security advisory and specific patch commit suggests the vulnerability has been publicly disclosed with technical details that could facilitate exploitation. The time-based blind SQL injection technique is well-documented and automatable, making this exploitable by moderately skilled attackers once they obtain any valid user account. Organizations running AVideo should prioritize patching, especially if the platform is exposed to untrusted authenticated users.

An attacker creates a standard user account on an AVideo platform or obtains credentials through social engineering or credential stuffing. They then craft malicious HTTP requests to the remindMe.json.php endpoint with specially crafted live_schedule_id parameters containing SQL injection payloads designed for time-based blind extraction, such as using SLEEP() or BENCHMARK() functions. By measuring response times across multiple requests with different payloads, the attacker systematically extracts administrator credentials, API keys, user personal information, and video access records from the database, enabling account takeover and unauthorized access to private content.