PT-2026-26772 · Unknown+1 · Livetransmitionhistory+2

Danielnetodotcom · Published 2026-03-20 · Updated 2026-03-23 · CVE-2026-33485

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions up to and including 26.0

Description The RTMP on publish callback at plugin/Live/on publish.php lacks authentication. The $ POST['name'] parameter, representing the stream key, is directly incorporated into SQL queries within the LiveTransmitionHistory::getLatest() and LiveTransmition::keyExists() functions without proper sanitization or parameterized binding. This allows an unauthenticated attacker to perform time-based blind SQL injection, potentially extracting all database contents, including user password hashes, email addresses, and other sensitive data. The insufficient sanitization on line 117 of plugin/Live/on publish.php only strips '&' and '=' characters. The sqlDAL::readSql() function does not provide protection when called without format/values parameters, as it compiles the injected SQL directly. Exploitation can be achieved through crafted curl requests, leveraging the injection points to extract data character by character. An attacker could potentially authenticate as any user to the streaming system by using extracted password hashes.

Recommendations Versions up to and including 26.0: Use parameterized queries in the LiveTransmition::keyExists() function at plugin/Live/Objects/LiveTransmition.php:298-303. Versions up to and including 26.0: Use parameterized queries in the LiveTransmitionHistory::getLatest() function at plugin/Live/Objects/LiveTransmitionHistory.php:494-495. Versions up to and including 26.0: Use parameterized queries in the LiveTransmitionHistory::getLatestFromKey() function at plugin/Live/Objects/LiveTransmitionHistory.php:681-688.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33485

GHSA-8P58-35C3-CCXX

Affected Products

Avideo

Livetransmition

Livetransmitionhistory

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33485.json · Exploit
• https://github.com/WWBN/AVideo/commit/af59eade82de645b20183cc3d74467a7eac76549 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8p58-35c3-ccxx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33485 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8p58-35c3-ccxx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33485 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2036214134690222370 · Twitter Post