PT-2022-22271 · Wwbn · Avideo

Claudio Bozzato · Published 2022-08-22 · Updated 2022-08-24 · CVE-2022-34652

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WWBN AVideo version 11.6 WWBN AVideo dev master commit 3f7c0364

Description A SQL injection issue exists in the ObjectYPT functionality, specifically within the Live Schedules plugin. This allows an attacker to inject SQL by manipulating the description parameter in a specially-crafted HTTP request. As a result, an attacker can send an HTTP request to trigger this issue.

Recommendations For WWBN AVideo version 11.6, consider restricting access to the Live Schedules plugin until a fix is available. For WWBN AVideo dev master commit 3f7c0364, avoid using the description parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-34652

Affected Products

Avideo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-34652 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34652 · Vendor Advisory
• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551 · Note