# AVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()

Authenticated user injects SQL via live_schedule_id in AVideo's remindMe endpoint; intval() on a local copy leaves the tainted value, enabling time-based blind DB extraction.

- Payout: Research
- Severity: high
- Program: AVideo
- Found by: offset
- Disclosed: 2026-03-25
- CVE: CVE-2026-33651
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-pvw4-p2jm-chjm
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-pvw4-p2jm-chjm
- Tags: area:web domain:web impact:ato impact:data-leak kind:research platform:ghsa sev:high tech:php technique:blind technique:source-review vuln:sqli

**Target:** PHP web endpoint plugin/Live/remindMe.json.php and Scheduler_commands SQL query
**Root cause:** live_schedule_id is passed unsanitized through Live::setLiveScheduleReminder into getLiveScheduleReminderBaseNameType, which concatenates it into a LIKE clause in Scheduler_commands::getAllActiveOrToRepeat(); intval() in ObjectYPT::getFromDb() only sanitizes a local copy.
**Steps:**
1. Authenticate as any user and obtain a PHPSESSID.
2. Baseline: `curl -b "PHPSESSID=<valid_session>" "http://target/plugin/Live/remindMe.json.php?live_schedule_id=1&minutesEarlier=10"` returns in ~0.1-0.5s.
3. Inject: `--get --data-urlencode 'live_schedule_id=1" AND SLEEP(5) -- '` to remindMe.json.php; response delayed ~5s.
4. Extract data: `live_schedule_id=1" AND IF(SUBSTRING(user(),1,1)="r",SLEEP(5),0) -- '` and observe delay to confirm character.
**How found:** Code-reading traced the 6-step data flow from $_REQUEST['live_schedule_id'] to the SQL sink, noticing that intval() inside ObjectYPT::getFromDb() sanitizes only the local parameter, leaving the caller's variable tainted.
**Exploitation:** Any authenticated session sends live_schedule_id containing a quote-break payload; intval() loads schedule 1 so the request proceeds, while the raw string reaches the LIKE clause, allowing time-based blind extraction of DB contents character by character (admin hashes, PII, tokens) and potentially writes via stacked/subqueries.
**Escalation:** Extracted admin password hashes or session tokens enable full platform compromise/account takeover.
**Insight:** When a sink is reached via a value that passed through an object constructor, check whether sanitization happens on a local copy inside getFromDb() rather than the caller's variable — the tainted original often continues downstream into string-built queries.

## Proof of concept (copied exactly from the original report)

**Resulting injected SQL query**

```
SELECT * FROM scheduler_commands
WHERE (status='a' OR status='r')
  AND `type` LIKE "LiveScheduleReminder_123_1" AND SLEEP(5) -- %"
```