WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.
Content owners can password-protect individual videos on the AVideo platform. The platform stores these passwords directly in the database as plaintext (CWE-312 — storage of sensitive data without encryption). An attacker who gains read access to the database — via SQL injection, backup leak, or misconfigured permissions — receives all video passwords in readable form without the need to crack them.
An attacker can gain unauthorized access to all password-protected videos by bypassing the access control mechanism. Exposed passwords can also be used in attacks on other resources if users apply the same passwords elsewhere.
Apply the patch contained in commit f2d68d2adbf73588ea61be2b781d93120a819e36 available in the WWBN/AVideo GitHub repository. It is also recommended to enforce a password change for all video passwords after the update that may have been previously exposed.
WWBN AVideo in versions up to 26.0 inclusive
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XWwbn Avideo
APPWwbn≤ 26.0
Related vulnerabilities
WWBN AVideo — niekompletna naprawa command injection w test.php
WWBN AVideo: RCE przez eval() w pluginie YPTSocket — przejęcie kont
SQL Injection w WWBN AVideo — mechanizm uwierzytelniania RTMP
SSRF w WWBN AVideo — brak walidacji parametru URL w saveDVR.json.php
RCE bez uwierzytelnienia w WWBN AVideo — łańcuch podatności w pluginie CloneSite