CVE-2026-33352: WWBN AVideo SQL Injection Vulnerability

CVE-2026-33352 Overview

CVE-2026-33352 is a critical unauthenticated SQL injection vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability exists in objects/category.php within the getAllCategories() method, where the doNotShowCats request parameter is inadequately sanitized. The sanitization only strips single-quote characters using str_replace("'", '', ...), which can be trivially bypassed using a backslash escape technique to shift SQL string boundaries. This parameter is not covered by any of the application's global input filters in objects/security.php, allowing attackers to inject arbitrary SQL commands without authentication.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to extract sensitive data from the database, modify or delete records, and potentially achieve full database compromise on affected WWBN AVideo installations prior to version 26.0.

Affected Products

• WWBN AVideo versions prior to 26.0
• All installations using the vulnerable objects/category.php component

Discovery Timeline

• 2026-03-23 - CVE-2026-33352 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33352

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) stems from insufficient input validation in the category management functionality of WWBN AVideo. The getAllCategories() method in objects/category.php accepts user-controlled input through the doNotShowCats parameter, which is intended to filter categories from query results. The application attempts to sanitize this input by stripping single-quote characters, a common but fundamentally flawed approach to preventing SQL injection.

The backslash escape technique allows attackers to circumvent this protection by manipulating SQL string boundaries. When a backslash is placed before the stripped quote location, it escapes the subsequent character in the SQL statement, effectively breaking the intended query structure and allowing injection of arbitrary SQL commands.

Root Cause

The root cause is inadequate input sanitization combined with missing coverage by global security filters. The application relies on a naive single-quote removal technique (str_replace("'", '', ...)) rather than using parameterized queries or prepared statements. Additionally, the doNotShowCats parameter is not protected by the application's global input filters defined in objects/security.php, creating a gap in the security architecture that exposes this attack surface.

Attack Vector

The attack can be executed remotely over the network without any authentication requirements. An attacker can craft malicious HTTP requests containing specially formatted payloads in the doNotShowCats parameter. By utilizing backslash escape sequences, the attacker can shift SQL string boundaries and inject arbitrary SQL commands that will be executed against the backend database.

The vulnerability is exploited by sending a crafted request to endpoints that call the getAllCategories() method with attacker-controlled doNotShowCats values. The backslash technique works by placing a backslash character that escapes whatever character follows the position where the single quote was stripped, allowing the attacker to break out of the string context and append malicious SQL. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-33352

Indicators of Compromise

• Unusual or malformed HTTP requests targeting objects/category.php or endpoints calling getAllCategories()
• Requests containing backslash characters combined with SQL keywords in the doNotShowCats parameter
• Database error messages in application logs indicating malformed SQL queries
• Unexpected database query patterns or data exfiltration attempts in database logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns including backslash escape sequences
• Monitor HTTP request logs for suspicious doNotShowCats parameter values containing SQL syntax or escape characters
• Configure database auditing to flag unusual query patterns from the AVideo application context
• Deploy intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Enable detailed access logging for web server endpoints serving the AVideo application
• Configure alerting on database queries containing UNION, SELECT, or other SQL keywords from user-supplied parameters
• Monitor for increased error rates in application logs that may indicate exploitation attempts
• Review database connection logs for anomalous query execution patterns

How to Mitigate CVE-2026-33352

Immediate Actions Required

• Upgrade WWBN AVideo to version 26.0 or later immediately
• If immediate upgrade is not possible, restrict access to the application using network-level controls
• Implement WAF rules to block requests with suspicious patterns in the doNotShowCats parameter
• Review database logs for evidence of prior exploitation

Patch Information

WWBN has released version 26.0 which addresses this vulnerability. The fix is available in commit 206d38e97b8c854771bb2907b13f9f36e8bcf874. Organizations should upgrade to version 26.0 or apply the patch as soon as possible. Additional details are available in the GitHub Security Advisory GHSA-mcj5-6qr4-95fj.

Workarounds

• Implement a reverse proxy or WAF rule to block requests containing backslash characters or SQL keywords in the doNotShowCats parameter
• Restrict network access to the AVideo application to trusted IP addresses only
• If possible, temporarily disable the category filtering functionality until the patch can be applied
• Monitor and audit all database activity for signs of SQL injection exploitation

# Example WAF rule to block suspicious doNotShowCats parameter patterns
# ModSecurity rule example
SecRule ARGS:doNotShowCats "@rx (?i)(\\x5c|union|select|insert|update|delete|drop)" \
    "id:2026333520,phase:2,deny,status:403,msg:'Potential SQL injection attempt in doNotShowCats parameter'"