CVE-2026-33651: WWBN AVideo SQL Injection Vulnerability

CVE-2026-33651 Overview

A SQL injection vulnerability has been identified in WWBN AVideo, an open source video platform. In versions up to and including 26.0, the remindMe.json.php endpoint passes $_REQUEST['live_schedule_id'] through multiple functions without proper sanitization until it reaches Scheduler_commands::getAllActiveOrToRepeat(), which directly concatenates it into a SQL LIKE clause. Although intermediate functions (new Live_schedule(), getUsers_idOrCompany()) apply intval() internally, they do so on local copies within ObjectYPT::getFromDb(), leaving the original tainted variable unchanged. This allows any authenticated user to perform time-based blind SQL injection to extract arbitrary database contents.

Critical Impact

Authenticated attackers can exploit this SQL injection vulnerability to extract sensitive database contents including user credentials, video metadata, and other confidential information stored in the AVideo platform database.

Affected Products

• WWBN AVideo versions up to and including 26.0
• All installations using the remindMe.json.php endpoint
• Systems with the Scheduler plugin enabled

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-33651 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33651

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection) and affects the remindMe.json.php endpoint in the AVideo platform's Live plugin. The core issue stems from improper handling of user-controlled input where the live_schedule_id parameter flows through the application without adequate sanitization before being used in SQL query construction.

The vulnerability specifically manifests because while some intermediate functions apply intval() conversion, these sanitization efforts occur on local variable copies rather than the original request parameter. This architectural flaw means the tainted data persists through the call chain until it reaches Scheduler_commands::getAllActiveOrToRepeat(), where it's concatenated directly into a SQL LIKE clause without parameterization.

Root Cause

The root cause is insufficient input validation at the point of entry combined with inadequate defense-in-depth throughout the data flow. The $_REQUEST['live_schedule_id'] parameter is not sanitized before being passed to downstream functions. While internal functions attempt sanitization via intval(), they operate on local copies within ObjectYPT::getFromDb(), failing to modify the original tainted variable that continues through the execution path.

Attack Vector

An authenticated attacker can exploit this vulnerability by crafting malicious SQL payloads within the live_schedule_id parameter. Since the vulnerability enables time-based blind SQL injection, attackers can methodically extract database contents by observing response timing differences. This attack requires only basic authentication to the AVideo platform and can be executed remotely over the network without user interaction.

The following patch was applied to address this vulnerability:

     $_REQUEST['minutesEarlier'] = 10;
 }
 
+$_REQUEST['live_schedule_id'] = intval($_REQUEST['live_schedule_id']);
+
 $reminder = Live::setLiveScheduleReminder($_REQUEST['live_schedule_id'], $_REQUEST['minutesEarlier'], @$_REQUEST['deleteIfExists']);
 
 $obj = new stdClass();

Source: GitHub Commit Details

The fix ensures that intval() is applied directly to $_REQUEST['live_schedule_id'] before it's used anywhere in the application, effectively sanitizing the input at the entry point.

Detection Methods for CVE-2026-33651

Indicators of Compromise

• Unusual or malformed values in the live_schedule_id parameter within HTTP request logs
• Time-delayed responses from the remindMe.json.php endpoint indicating potential time-based SQL injection attempts
• SQL error messages or database timeouts associated with the Live plugin endpoints
• Anomalous database query patterns or unexpected SELECT statements originating from the web application

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns in the live_schedule_id parameter
• Monitor access logs for requests to /plugin/Live/remindMe.json.php with suspicious parameter values
• Deploy database activity monitoring to identify unusual query patterns or time-based extraction attempts
• Configure intrusion detection systems to alert on SQLi attack signatures targeting the AVideo application

Monitoring Recommendations

• Enable detailed logging for the AVideo Live plugin and associated database queries
• Set up alerts for response time anomalies on the remindMe.json.php endpoint
• Monitor authenticated user sessions for unusual activity patterns following login
• Implement database query auditing to track queries containing LIKE clauses from the Scheduler module

How to Mitigate CVE-2026-33651

Immediate Actions Required

• Update WWBN AVideo to a version containing commit 75d45780728294ededa1e3f842f95295d3e7d144 or later
• Review access logs for evidence of exploitation attempts against the remindMe.json.php endpoint
• Consider temporarily disabling the Live Scheduler functionality if patching is not immediately possible
• Audit database contents for signs of unauthorized data extraction

Patch Information

WWBN has released a security patch in commit 75d45780728294ededa1e3f842f95295d3e7d144. The fix applies intval() sanitization directly to the $_REQUEST['live_schedule_id'] parameter at the entry point in plugin/Live/remindMe.json.php, ensuring the value is converted to an integer before any further processing. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement a web application firewall rule to filter and sanitize the live_schedule_id parameter
• Restrict access to the remindMe.json.php endpoint to trusted users only via server configuration
• Deploy network-level controls to limit access to the AVideo administrative interfaces

# Example: Apache mod_rewrite rule to block non-numeric live_schedule_id values
RewriteEngine On
RewriteCond %{QUERY_STRING} live_schedule_id=[^0-9] [NC]
RewriteRule ^plugin/Live/remindMe\.json\.php$ - [F,L]