AVideo versions up to 29.0 have an unauthenticated SQL injection in the User_Location plugin’s regions.json.php and cities.json.php endpoints. The country and region GET parameters are incorporated directly into SQL queries without any escaping or prepared statement binding, allowing an attacker to perform a UNION-based injection that can read any table in the database. This flaw falls under CWE‑89 and can disclose sensitive data such as user credentials and personal information.

The vulnerability is present in the AVideo product from the vendor WWBN. All releases up to and including version 29.0 are affected.

The CVSS score of 8.7 categorizes this flaw as high severity, and it can be exploited by unauthenticated users over the network through the public HTTP endpoints. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Given that the exploitation requires only a crafted GET request to the vulnerable endpoints, the risk of exploitation is significant if the application is exposed to the internet. An attacker could extract database contents resulting in confidentiality compromise and potential credential theft.