Avideo CVE-2026-33681

WWBN AVideo versions up to 26.0. Requires authenticated admin access or CSRF against an admin user. Attacker sends POST request to objects/pluginRunDatabaseScript.json.php with malicious name parameter containing path traversal sequences to execute arbitrary install/install.sql files as SQL queries.

Despite the CVSS score of 7.2, this vulnerability presents significant real-world risk due to multiple exploitation paths. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity requiring high privileges (admin access). However, the CSRF attack vector substantially lowers the privilege barrier, as an authenticated admin merely needs to visit a malicious page, effectively reducing PR:H to PR:N in practical scenarios. The technical impact is critical: arbitrary SQL execution can lead to complete database compromise, data exfiltration, privilege escalation, and potentially remote code execution through SQL-based file operations. The availability of a GitHub Security Advisory (GHSA-3hwv-x8g3-9qpr) and a specific patch commit indicates active vendor response but also provides attackers with patch-diff analysis opportunities. Organizations running AVideo should treat this as a high-priority remediation target, particularly if the admin interface is exposed to the internet or if CSRF protections are weak.

An attacker crafts a malicious webpage that, when visited by an authenticated AVideo administrator, submits a POST request to objects/pluginRunDatabaseScript.json.php with a 'name' parameter containing path traversal sequences like '../../../../tmp/malicious/install.sql'. This CSRF attack causes the application to locate and execute the attacker-controlled SQL file, allowing the attacker to create administrative accounts, dump sensitive user data, modify video access controls, or execute system commands via SQL functions like xp_cmdshell or INTO OUTFILE, achieving complete platform compromise without requiring direct admin credentials.