CVE-2022-33147 — SQL Injection in Avideo

CWE-89 — SQL Injection4 documents3 sources
Severity
8.8HIGHNVD
EPSS
3.0%
top 13.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wwbn Avideo
Timeline
PublishedAug 22
Latest updateAug 23

Description

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5wwbn/avideodev master commit 3f7c0364
▶NVDwwbn/avideo11.6

🔴Vulnerability Details

1
GHSA
GHSA-vgrg-5wpm-gwfh: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11↗2022-08-23
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass↗2022-08-16
▶
Talos
Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass↗2022-08-16
▶