CVE-2026-33867: AVideo has Plaintext Video Password Storage

Summary

AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext.

Details

File: objects/video.php

Vulnerable setter: php public function setVideopassword($videopassword) { AVideoPlugin::onVideoSetVideopassword($this->id, $this->videopassword, $videopassword); $this->videopassword = trim($videopassword); }

Vulnerable getter: php public function getVideopassword() { if (empty($this->videopassword)) { return ''; } return trim($this->videopassword); }

The value assigned to $this->videopassword is only trim()-ed before being persisted to the database column videopassword in the videos table. There is no call to any hashing function (e.g., passwordhash(), sha256, or similar).

When a visitor enters a password to access a protected video, the comparison is done directly against the stored plaintext: php // Comparison at access check: if ($video->getVideopassword() === $POST['password']) { ... }

This means: 1. Any database read (SQL injection, backup leak, hosting panel access) exposes all video passwords as cleartext. 2. Video passwords are often reused by users across other services, making this a credential harvesting risk. 3. The plaintext value is also present in application memory and any query logs.

PoC

1. Set a password on any video via the AVideo admin/creator UI. 2. Query the database: SELECT cleantitle, videopassword FROM videos WHERE videopassword != ''; 3. All video passwords are returned in plaintext — no cracking required.

Alternatively, exploit any of the SQL injection vulnerabilities already reported in this repository to extract the videopassword column directly.

Impact

- Type: Cleartext Storage of Sensitive Information (CWE-312) - Severity: High - Authentication required: No — any database read access (including via SQL injection by unauthenticated users) exposes all passwords - Impact: Full exposure of all video access passwords; credential reuse attacks against users who share passwords across services - Fix: Hash video passwords on write using passwordhash($videopassword, PASSWORDBCRYPT) and verify on read using passwordverify($POST['password'], $storedhash)