A blind SQL injection vulnerability exists in the AVideo platform’s remindMe.json.php endpoint, allowing any authenticated user to inject malicious SQL through the live_schedule_id parameter. The application passes this value through several functions without proper sanitization; only local copies are converted to integers, leaving the original tainted variable to be concatenated directly into a SQL LIKE clause. This flaw permits attackers to perform time‑based blind injections and retrieve arbitrary database contents, potentially exposing confidential user data and system configuration. The underlying weakness is identified as CWE‑89 and can lead to significant confidentiality compromise, and if the database contains privileged information, it could also impact integrity.

The affected product is WWBN AVideo, an open source video platform. Versions up to and including 26.0 are vulnerable. The issue stems from the remindMe.json.php endpoint in the scheduler component, which relies on the live_schedule_id request parameter. Upgrading beyond version 26.0 or applying the vendor patch eliminates the flaw.

The CVSS score of 8.1 indicates a high severity, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation yet. A valid authenticated session is required to exploit the flaw, and the attack vector is inferred to be a remote web-based request to the remindMe.json.php endpoint. Because the attack requires sustained time‑based queries to infer data, successful exploitation would likely be noticeable to vigilant monitoring. Overall, the risk remains high due to the severe impact of data exfiltration, despite the low EPSS.