CVE-2022-33147 - CVE House
Back to Database
Status published High CVE-2022-33147

A sql injection vulnerability exists in the ObjectYPT functionality of...

Vulnerability Description

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-33147

Credits & Attribution

No credits recorded in the NVD database.

References

More from WWBN

View All →
CVE-2025-53084
A cross-site scripting (xss) vulnerability exists in the videosList page...
Critical 9
CVE-2025-50128
A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg...
Critical 9.6
CVE-2025-48732
An incomplete blacklist exists in the .htaccess sample of WWBN...
High 7.3
CVE-2025-46410
A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId...
Critical 9.6
CVE-2025-41420
A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri...
Critical 9.6

Affected Vendor

Affected Software

AVideo
Vulnerable Versions:
11.6, dev master commit 3f7c0364

Timeline

Official Publish: August 22nd, 2022
Last Modified: April 15th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact