Executive brief
AVideo's User_Location plugin provides geographic data lookup features for videos and user interactions. An unauthenticated attacker can read the entire application database—including admin password hashes, user credentials, and sensitive data—by sending specially crafted web requests to the plugin's API endpoints. No authentication, login, or special configuration is required; the vulnerability affects all installations with the plugin enabled.
Technical details
The User_Location plugin's regions.json.php and cities.json.php endpoints accept country and region parameters via GET requests and pass them directly into SQL queries without escaping, parameterization, or input validation. The vulnerable code constructs raw SQL strings with unsanitized user input, then passes them to sqlDAL::readSql() which calls mysqli::prepare() with no bound parameters, allowing the interpolated injection payload to reach the database engine. An unauthenticated attacker can exploit UNION-based SQL injection to read arbitrary data from any table, including the users table and its password hashes. The vulnerability requires only that an admin has enabled the User_Location plugin, which is a standard documented feature; no patches are currently available.
Affected products
- WWBN AVideo through 29.0
Timeline
- 2026-08-18: disclosed
- 2026-09-01: advisory