WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method is called as a fallback from `LiveTransmition::keyExists()` when the initial parameterized lookup returns no results. Although the calling function correctly uses parameterized queries for its own lookup, the fallback path to `Live_schedule::keyExists()` undoes this protection entirely. This vulnerability is distinct from GHSA-pvw4-p2jm-chjm, which covers SQL injection via the `live_schedule_id` parameter in the reminder function. This finding targets the stream key lookup path used during RTMP publish authentication. As of time of publication, no patched versions are available.
The `Live_schedule::keyExists()` method constructs an SQL query by directly inserting the stream key into the query content without using parameterization. This method is called as a fallback mechanism from `LiveTransmition::keyExists()` — when the proper parameterized query returns no results, control passes to the vulnerable path. In this way, the security applied in the calling function is completely neutralized by the unprotected fallback. This vulnerability is separate from the previously reported GHSA-pvw4-p2jm-chjm vulnerability concerning the `live_schedule_id` parameter.
An unauthenticated attacker can manipulate SQL queries directed to the database, which may lead to unauthorized reading or modification of data stored by the platform, including user data and configuration.
According to information available at the time of publication, there is no patched version yet. You should monitor the project repository and the vendor's advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88 and apply patches immediately after they become available. Until patches are released, it is recommended to restrict access to RTMP endpoints using firewall and network rules.
WWBN AVideo in versions up to and including 26.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NWwbn Avideo
APPWwbn≤ 26.0
Related vulnerabilities
WWBN AVideo — niekompletna naprawa command injection w test.php
WWBN AVideo: RCE przez eval() w pluginie YPTSocket — przejęcie kont
WWBN AVideo: hasła do filmów przechowywane w bazie jako plaintext
SSRF w WWBN AVideo — brak walidacji parametru URL w saveDVR.json.php
RCE bez uwierzytelnienia w WWBN AVideo — łańcuch podatności w pluginie CloneSite