EUVD-2026-277180

fkie_cve-2026-33723

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Subscribe::save()` method in `objects/subscribe.php` concatenates the `$this->users_id` property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from `$_POST['user_id']` in both `subscribe.json.php` and `subscribeNotify.json.php`. An authenticated attacker can inject arbitrary SQL to extract sensitive data from any database table, including password hashes, API keys, and encryption salts. Commit 36dfae22059fbd66fd34bbc5568a838fc0efd66c contains a patch.

GHSA-ffr8-fxhv-fv8h — AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter

Affected: Packagist: wwbn/avideo

## Summary

The `Subscribe::save()` method in `objects/subscribe.php` concatenates the `$this->users_id` property directly into an INSERT SQL query without sanitization or parameterized binding. This property originates from `$_POST['user_id']` in both `subscribe.json.php` and `subscribeNotify.json.php`. An authenticated attacker can inject arbitrary SQL to extract sensitive data from any database table, including password hashes, API keys, and encryption salts.

## Details

The vulnerability exists because of a disconnect between where `intval()` is applied and where the value is used in SQL.

**Entry points** — `objects/subscribe.json.php:40` and `objects/subscribeNotify.json.php:23`:

```php // subscribe.json.php line 40 $subscribe = new Subscribe(0, $_POST['email'], $_POST['user_id'], User::getId()); ```

**Constructor stores raw value** — `objects/subscribe.php:34`:

```php public function __construct($id, $email = "", $user_id = "", $subscriber_users_id = "") { // ... $this->users_id = $user_id; // Raw $_POST['user_id'], no sanitization $this->subscriber_users_id = $subscriber_users_id; if (empty($this->id)) { $this->loadFromId($this->subscriber_users_id, $user_id, ""); } } ```

**`getSubscribeFromID` sanitizes local copies only** — `objects/subscribe.php:137-139`:

```php public static function getSubscribeFromID($subscriber_users_id, $user_id, $status = "a"){ $subscriber_users_id = intval($subscriber_users_id); // Local variable only…

Most recent entries from all

EUVD-2026-277180

fkie_cve-2026-33723

GHSA-ffr8-fxhv-fv8h — AVideo is Vulnerable to SQL Injection through Subscribe Endpoint via Unsanitized user_id Parameter