8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33038

CVE-2026-33038: AVideo affected by unauthenticated application takeover via exposed web installer on uninitialized deployments

WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initialization: database setup, admin account creation, and configuration file write, all from an unauthenticated POST input. The only guard is checking whether videos/configuration.php already exists. On uninitialized deployments, any remote attacker can complete the installation with attacker-controlled credentials and an attacker-controlled database, gaining full administrative access. This issue has been fixed in version 26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33038

CVE-2026-33038:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-2f9h-23f7-8gcx, allows for a complete application takeover of AVideo during an uninitialized deployment. The root cause is a lack of authentication on the installer script, install/checkConfiguration.php. This script is responsible for critical setup operations, including database initialization, admin account creation, and writing the main configuration file.

An attacker can exploit this by sending a direct POST request to /install/checkConfiguration.php on a new or uninitialized AVideo instance. The script uses raw $_POST data to perform its functions, which allows the attacker to:

Point the application to an attacker-controlled database.
Set the administrator password, gaining full control.
Inject arbitrary SQL due to unsanitized input ($_POST['contactEmail']) being concatenated directly into an SQL query for user creation.

The patch b3fa7869dcb935c8ab5c001a88dc29d2f92cf8e1 rectifies these issues by:

Implementing a CSRF token check, ensuring that the installation can only be triggered from a legitimate session that has loaded the installation wizard (install/index.php).
Replacing the vulnerable SQL query with a prepared statement, thus mitigating the SQL injection vulnerability.

The primary vulnerable component is the install/checkConfiguration.php script itself. As the code is executed in the global scope of the script rather than within a defined function, a runtime profiler would indicate the execution of this script as the entry point of the attack.

Vulnerable functions

checkConfiguration.php

install/checkConfiguration.php

The entire script `install/checkConfiguration.php` is vulnerable. It is accessible without authentication and performs the initial application setup, including creating the admin user and writing the configuration file. An attacker can send a POST request with crafted parameters to take over the application. The script directly uses `$_POST` variables to connect to a database, create an admin user (with a SQL injection vulnerability), and write the `videos/configuration.php` file. Since the vulnerable code is not within a specific function, the entire script is considered the vulnerable component that would appear in a profiler's output during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.