A pre-authentication SQL injection exists in the streamer login endpoint of the AVideo-Encoder platform. The user parameter is directly concatenated into a single-quoted MariaDB SELECT without proper escaping or parameterisation, allowing an attacker to inject UNION fragments. Because the server returns the rendered query and MariaDB error messages on failure, the vulnerability can be used to read arbitrary database contents, including stored upstream credentials, configuration, and queue records. The flaw is a classic SQL injection (CWE‑89) that impacts confidentiality by enabling information disclosure without requiring encoder credentials.

The vulnerability affects the WWBN AVideo-Encoder product in any release prior to version 8.1.0. Attackers can target the unsecured objects/login.json.php endpoint, which is reachable without authentication and accepts a user parameter that can be exploited if the attacker hosts a crafted login response and configures the request to trigger the vulnerable code path.

The CVSS score of 7.5 indicates a high severity issue, and while an EPSS score is not available the lack of a KEV listing suggests no known widespread exploitation yet. The attack vector is a remote unauthenticated HTTP request; the requirements are an attacker‐controlled user value, a hosted login response that sets canUpload or isAdmin, and a siteURL that passes the allowlist (which defaults to allow all sites when empty). Stacked statements are not supported and the database account lacks additional privileges, so the exploit is limited to data extraction rather than code execution. Nonetheless, the ability to read upstream credentials and other sensitive data can lead to continued unauthorized upstream access until credentials are rotated.