Description

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-01T23:17:21.353Z",
  "pubdate": "2026-09-01T23:17:21.353Z",
  "executiveSummary": "AVideo versions through 29.0 are susceptible to an unauthenticated SQL injection vulnerability residing within the User_Location plugin.\nThis flaw allows remote, unauthenticated attackers to manipulate database queries via the regions.json.php and cities.json.php endpoints.\nBy injecting malicious SQL syntax into the 'country' and 'region' GET parameters, an attacker can bypass standard query logic to perform unauthorized data exfiltration.\nThe vulnerability poses a severe risk to confidentiality, as it facilitates UNION-based SQL injection, enabling the retrieval of sensitive database contents, including user password hashes and internal configuration data.\nSuccessful exploitation does not require prior authentication or elevated privileges, making it a critical threat to internet-facing AVideo installations.\nImmediate remediation is required to sanitize input parameters or transition to parameterized query execution to prevent unauthorized database interactions.",
  "technicalDetails": "The root cause of this vulnerability is the improper neutralization of user-supplied input within the User_Location plugin. Specifically, the PHP scripts located at regions.json.php and cities.json.php fail to implement input sanitization or parameterized queries (prepared statements) before concatenating user-controlled GET parameters into SQL execution strings.\nThe affected components accept 'country' and 'region' parameters directly from the HTTP request query string. Because these variables are treated as trusted input, the underlying database driver executes them as part of the intended SQL command. This behavior permits an attacker to escape the intended query structure by injecting SQL control characters and keywords.\nThe exploitation method leverages UNION-based SQL injection techniques. An attacker can craft a malicious HTTP GET request targeting either endpoint, appending a payload that includes a UNION SELECT statement. This allows the attacker to append the results of their own injected query to the legitimate query results, effectively extracting data from other tables within the database schema.\nThe attack flow follows these steps: 1) The attacker identifies the vulnerable endpoints regions.json.php or cities.json.php. 2) The attacker crafts a request where the 'country' or 'region' parameter includes a payload such as '1 UNION SELECT password, username FROM users'. 3) The server-side application concatenates this input into the backend SQL query without escaping. 4) The database engine processes the malicious union, executing the unauthorized select statement. 5) The application returns the concatenated results in the HTTP response body, exposing sensitive database contents to the attacker.\nThis vulnerability is particularly impactful because it bypasses all application-level authentication mechanisms. Since the vulnerable endpoints are reachable without session validation, the attack surface is globally exposed to any network entity capable of reaching the web server hosting the AVideo instance. The potential for post-exploitation includes full account takeover via password hash cracking, administrative credential theft, and unauthorized exposure of PII (Personally Identifiable Information) stored within the AVideo database, depending on the database user's privileges configured in the environment."
}