PT-2022-21709 · Wwbn · Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2022-08-24 · CVE-2022-33147

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 11.6

Description A SQL injection issue exists in the ObjectYPT functionality, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter in the aVideoEncoder functionality, which can be used to add new videos. This can be triggered by a specially-crafted HTTP request.

Recommendations For version 11.6, consider restricting access to the aVideoEncoder functionality until a patch is available. As a temporary workaround, avoid using the videoDownloadedLink or duration parameter in the affected functionality to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-33147

Affected Products

Avideo

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-33147 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33147 · Vendor Advisory
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551 · Note
• https://t.me/cibsecurity/48545 · Telegram Post