This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: SQL Injection in WWBN AVideo. ๐ฅ **Consequences**: Attackers can manipulate database queries via the `catName` parameter in `objects/videos.json.php` and `objects/video.php`.โฆ
๐ก๏ธ **Root Cause**: **CWE-89** (SQL Injection). ๐ **Flaw**: Improper sanitization/cleaning of the `catName` input parameter. The system fails to validate or escape user-supplied data before embedding it in SQL commands.
Q3Who is affected? (Versions/Components)
๐ฅ **Affected**: **WWBN AVideo** (PHP-based video platform). ๐ **Versions**: All versions **prior to 24.0**. ๐ฆ **Components**: Specifically `objects/videos.json.php` and `objects/video.php`.
Q4What can hackers do? (Privileges/Data)
๐ **Capabilities**: Full SQL injection potential. ๐ **Impact**: High Confidentiality, Integrity, and Availability loss (CVSS H).โฆ
๐งช **Exploit Status**: No specific PoC provided in the data. ๐ **Wild Exploitation**: Unknown. However, given the low complexity and lack of auth, public exploits are likely emerging or easily crafted by attackers.
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: Scan for WWBN AVideo instances. ๐ฏ **Target**: Check endpoints `/objects/videos.json.php` and `/objects/video.php`. ๐ **Test**: Inject SQL payloads into the `catName` parameter.โฆ
โ **Fixed**: **YES**. ๐ฆ **Patch**: Version **24.0** and later. ๐ **Reference**: GitHub Advisory GHSA-pv87-r9qf-x56p and Commit 0c10be6. Upgrade immediately to resolve the issue.
Q9What if no patch? (Workaround)
๐ง **No Patch?**: If stuck on old versions, implement **WAF rules** to block SQL injection patterns in the `catName` parameter.โฆ
๐ฅ **Urgency**: **CRITICAL**. ๐จ **Priority**: **P1**. With CVSS High severity, no auth required, and low complexity, this is a high-risk vulnerability. Immediate patching to v24.0+ is strongly recommended.