AVideo EUVD-2026-69717

The User_Location plugin must be installed and enabled on an AVideo instance running version 29.0 or earlier. The endpoints regions.json.php and cities.json.php must be reachable by the attacker over the network. No authentication is required (PR:N confirmed by CVSS vector), and no non-default AVideo configuration is needed beyond plugin activation. What limits exploitation: the attacker must be able to reach those specific PHP endpoint files - instances where these endpoints are not publicly routable, are protected by authentication middleware, or where the User_Location plugin is absent are not vulnerable through this path regardless of AVideo version.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the high real-world risk: no authentication, no complexity barriers, and a trivial HTTP GET-based vector make this straightforwardly exploitable against any internet-exposed AVideo instance with the User_Location plugin active. Even a mid-sized municipal IT team in malbork running a public-facing video portal should treat this as an urgent remediation, as UNION-based SQLi requires no specialized tooling and is well within reach of both automated scanners and low-skill attackers. The impact is scoped to confidentiality - VC:H with no integrity or availability component - but password hash exposure creates a realistic path to credential cracking and lateral movement across environments that reuse credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, which is the primary moderating factor; however, the extremely low exploitation complexity means this window narrows rapidly once detailed technical writeups proliferate following the advisory publication.

An unauthenticated attacker probes a public AVideo instance and confirms that the User_Location plugin is active by sending a benign GET request to regions.json.php. The attacker then appends a UNION-based SQL payload to the country parameter - such as appending UNION SELECT password,null,null FROM users - and issues the crafted HTTP GET request, receiving hashed administrator credentials embedded in the JSON response without any authentication or rate-limiting barrier. No exploit code has been identified at time of analysis, but the technique is elementary and well-documented for PHP applications lacking parameterized queries.