CVE-2026-33351 — AI Deep Analysis Summary

🚨 **What is this vulnerability?** * **Essence:** Server-Side Request Forgery (SSRF) in WWBN AVideo. * **Flaw:** The file `plugin/Live/standAloneFiles/saveDVR.json.php` is vulnerable. * **Consequence:** Unverified …

🛡️ **Root Cause? (CWE/Flaw)** * **CWE ID:** CWE-918 (SSRF). * **Technical Flaw:** Lack of input validation on `webSiteRootURL`. * **Mechanism:** User-controlled input is blindly passed to server-side HTTP requests…

👥 **Who is affected? (Versions/Components)** * **Vendor:** WWBN. * **Product:** AVideo (PHP-based video platform). * **Affected Versions:** **Before 26.0**. * **Specific File:** `plugin/Live/standAloneFiles/save…

💣 **What can hackers do? (Privileges/Data)** * **Data Access:** Read internal server files or sensitive data (C:H). * **Integrity:** Modify internal server responses or data (I:H). * **Network:** Probe internal ne…

🔓 **Is exploitation threshold high? (Auth/Config)** * **Auth Required:** **NO** (PR:N - Privileges Required: None). * **User Interaction:** **NO** (UI:N - User Interaction: None). * **Attack Vector:** Network (AV:…

🧪 **Is there a public Exp? (PoC/Wild Exploitation)** * **PoC Status:** No public PoC listed in data (`pocs: []`). * **References:** GitHub Advisory (GHSA-5f7v-4f6g-74rj) and Commit exist. * **Wild Exploitation:** …

🔍 **How to self-check? (Features/Scanning)** * **Target URL:** Look for `plugin/Live/standAloneFiles/saveDVR.json.php`. * **Parameter:** Check for `webSiteRootURL` in requests. * **Scanner:** Use SSRF scanners tar…

🩹 **Is it fixed officially? (Patch/Mitigation)** * **Fix Available:** **YES**. * **Version:** Upgrade to **AVideo 26.0** or later. * **Commit:** Fix committed at `d0c54960389eeb85e76caed5a257ae90e6a739f2`. * **A…

🚧 **What if no patch? (Workaround)** * **Input Validation:** Manually sanitize `webSiteRootURL` in the vulnerable file. * **Access Control:** Restrict access to `plugin/Live/` directory via WAF/Nginx. * **Network …

⚡ **Is it urgent? (Priority Suggestion)** * **Priority:** **HIGH**. * **Reason:** Remote, unauthenticated, low complexity. * **CVSS Score:** High impact on Confidentiality/Integrity. * **Action:** Patch immediat…