AVideo‑Encoder, a video‑sharing platform, contains a flaw in its installer endpoint install/checkConfiguration.php that allows any unauthenticated user to inject PHP code. The endpoint builds videos/configuration.php from request parameters by inserting values into single‑quoted strings with no escaping. Because the file is created only when videos/configuration.php does not already exist, a freshly deployed installation or one in which the file was removed is vulnerable. By terminating the literal with a quote and appending PHP, an attacker can cause the web‑server user to execute arbitrary code, read or overwrite any file writable by that user, and alter database connection settings. The same parameters are also inserted into SQL statements, providing an additional SQL‑injection sink.

Vulnerable accounts are deployments of WWBN:AVideo‑Encoder prior to version 8.1.0. The flaw is active only when the configuration file is missing, as on a fresh install or after the file has been moved. Any instance that meets these conditions and has the installer directory exposed to the internet is susceptible.

The CVSS score of 10 marks this issue as critical. EPSS data is not available, but the exploit requires only an HTTP request containing crafted parameters; no discovery or authentication is needed. Because the attacker can supply arbitrary database credentials, the attack can target any database the application can connect to. The vulnerability is not listed in CISA’s KEV catalog, yet its remote, unauthenticated nature and the widespread usage of AVideo‑Encoder mean that it should be treated as high risk and addressed urgently.