CVE-2026-33770— AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method in `objects/category.php` constructs a SQL SELECT query by directly interpolating both `$clean_title` and `$id` into the query string without using prepared statements or parameterized queries. An attacker who can trigger category creation or renaming with a crafted title value can inject arbitrary SQL. Commit 994cc2b3d802b819e07e6088338e8bf4e484aae4 contains a patch.

N/A

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

WWBN AVideo SQL注入漏洞

WWBN AVideo是WWBN团队的一个由PHP编写的视频平台建站系统。 WWBN AVideo 26.0及之前版本存在SQL注入漏洞，该漏洞源于objects/category.php中的fixCleanTitle()方法直接插值clean_title和id至SQL查询字符串，可能导致SQL注入。

N/A

N/A