CVE-2026-33767: 
PHP vulnerability analysis and mitigation

CVE-2026-33767 is a SQL injection vulnerability in WWBN AVideo's video liking functionality, classified as High severity. The flaw exists in objects/like.php where the getLike() method uses a partial prepared statement — parameterizing users_id but directly concatenating $this->videos_id into the SQL query string without sanitization. All versions of AVideo prior to 26.0 are affected. The vulnerability was published on March 24, 2026, and received a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically a partial prepared statement anti-pattern in objects/like.php. The vulnerable code constructs the query as: $sql = "SELECT * FROM likes WHERE users_id = ? AND videos_id = ".$this->videos_id." LIMIT 1;" — where users_id is bound via a placeholder but videos_id is concatenated directly from user-supplied POST/GET input without integer casting or validation. An authenticated attacker can exploit this via a crafted POST request to /objects/likeAjax.json.php, injecting a UNION-based SQL payload through the videos_id parameter. The fix, applied in commit 0215d3c, replaces the concatenation with a second ? placeholder and casts videos_id to an integer via intval() in both the constructor and the videosHashToID() function (GitHub Advisory, Patch Commit).

Successful exploitation allows any authenticated registered user to perform a full database read via UNION-based SQL injection, exposing user credentials (usernames and hashed passwords), email addresses, private content, and any other data accessible to the MySQL database user. Depending on the privileges granted to the database account, an attacker may also be able to modify or delete data. The broad attack surface — any registered user can trigger the like/dislike action — significantly increases the risk of exploitation in multi-tenant or publicly accessible AVideo deployments (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory (GHSA-fj74-qxj7-r3vc), which includes a specific, reproducible HTTP POST request demonstrating the UNION-based injection against the live endpoint. As of the advisory publication, there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.044% (0.000440), indicating a low but non-negligible probability of exploitation within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Authenticate: Log in to the target AVideo instance with any valid registered user account, as the vulnerable endpoint requires authentication.
2. Identify the target endpoint: Locate the like/dislike functionality, which submits requests to /objects/likeAjax.json.php via HTTP POST.
3. Craft the malicious payload: Construct a POST request with an injected videos_id parameter using a UNION-based SQL payload, e.g.:

   POST /objects/likeAjax.json.php
   videos_id=1 UNION SELECT user,password,3,4,5,6,7,8 FROM users-- -

4. Submit the request: Send the crafted POST request to the server. The backend executes:

   SELECT * FROM likes WHERE users_id = 1 AND videos_id = 1 UNION SELECT user,password,3,4,5,6,7,8 FROM users-- - LIMIT 1;

5. Extract data: Parse the JSON response to retrieve the injected data — user credentials, emails, and other database contents accessible to the MySQL user.
6. Escalate (optional): If the database user has write privileges, craft additional payloads to modify or delete records, or attempt further escalation depending on database configuration (GitHub Advisory).

• Network: Unusual HTTP POST requests to /objects/likeAjax.json.php containing SQL keywords such as UNION, SELECT, FROM, --, or encoded equivalents in the videos_id parameter.
• Logs: Web server access logs showing POST requests to /objects/likeAjax.json.php with abnormally long or non-numeric videos_id values; database error logs indicating unexpected SQL syntax or query structure anomalies.
• Application Behavior: Unexpected JSON responses from the like endpoint containing database field values (e.g., usernames, password hashes) rather than standard like/dislike status responses.
• Database: Unusual query patterns in MySQL general query logs involving UNION SELECT statements originating from the AVideo application's database user (GitHub Advisory).

Upgrade WWBN AVideo to version 26.0 or later, which includes the patch applied in commit 0215d3c (Patch Commit). The fix replaces the unsafe string concatenation with a fully parameterized query (? placeholder for both users_id and videos_id) and adds intval() casting in the Like class constructor and videosHashToID() function. As an interim workaround if immediate upgrade is not possible, apply the principle of least privilege to the database account used by AVideo to restrict UPDATE and DELETE permissions, limiting the potential impact of exploitation (GitHub Advisory).

The vulnerability was reported by security researcher athuljayaram and published by the AVideo maintainer DanielnetoDotCom on March 24, 2026. The advisory was noted on Bluesky via automated CVE tracking accounts shortly after NVD publication. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).