VULNERABILITY INTELLIGENCE

CVE-2022-33147

CVSS score8.8 HIGH

EPSS probability1.91%

CISA KEVNot currently listed

Published2022-08-22

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter.

Weakness classification

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references

talos-cna@cisco.com — Third Party Advisory
talos-cna@cisco.com — Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Technical Description, Third Party Advisory