SQL Injection Vulnerability in AVideo Live Streaming Plugin by WWBN

CVE-2026-33485

What is CVE-2026-33485?

AVideo, an open-source video platform, contains a vulnerability in versions up to and including 26.0. The RTMP 'on_publish' callback at 'plugin/Live/on_publish.php' is accessible without proper authentication controls, exposing the application to unauthorized access. This flaw allows an attacker to manipulate the '$_POST['name']' parameter, which is used in SQL queries unprotected by parameterized binding or escaping. As a result, attackers can perform time-based blind SQL injection attacks, potentially revealing sensitive database contents, including user passwords and email information. It is crucial for users of AVideo to update to the patched version referenced in the provided commit link to mitigate this risk.

References