Avideo CVE-2026-33723

Requires authenticated attacker account on WWBN AVideo versions ≤26.0. Attacker exploits SQL injection in Subscribe::save() method via crafted POST request to subscribe.json.php or subscribeNotify.json.php endpoints by injecting malicious SQL in user_id parameter. No victim interaction needed.

The CVSS v3.1 score of 7.1 (High) reflects Network attack vector, Low complexity, Low privileges required, and High confidentiality impact, making this a relatively accessible vulnerability for authenticated users. The PR:L requirement means any authenticated user account can exploit this, lowering the exploitation barrier significantly compared to admin-only vulnerabilities. The AC:L complexity indicates exploitation is straightforward once authentication is obtained. While EPSS data and KEV status are not provided in the intelligence, the combination of authenticated access requirement, clear technical details in the GitHub advisory (GHSA-ffr8-fxhv-fv8h), and availability of a patch commit suggests this is exploitable but requires initial access. The high confidentiality impact (C:H) is concerning as attackers can extract password hashes and API keys, potentially leading to privilege escalation and lateral movement. For organizations running AVideo with untrusted authenticated users, this represents a genuine priority requiring prompt patching.

An authenticated attacker logs into the AVideo platform with a standard user account and intercepts the POST request to subscribe.json.php or subscribeNotify.json.php. By manipulating the user_id parameter to include SQL injection payloads such as malicious UNION SELECT statements or stacked queries, the attacker extracts administrator password hashes, API keys, and database encryption salts from the database. The low attack complexity means exploitation can be achieved with readily available SQL injection tools, and the attacker can subsequently use the stolen credentials for privilege escalation or unauthorized access to protected content and administrative functions.