CVE-2022-33147

Katalog CVE

CVSS 8.8 · High EPSS 1,9%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada wwbn avideo. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter.

Rincian

Terbit di NVD

22 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql advisory pihak ketiga
• https://talosintelligence.com/vulnerability_reports/TALOS-2022-1551 deskripsi teknis · advisory pihak ketiga