CyberRota Analysis
AI-GeneratedAVideo versions prior to 29.0 are vulnerable due to an unauthenticated SQL injection flaw in the User_Location plugin's endpoints, which allows attackers to manipulate SQL queries through unvalidated GET parameters. This vulnerability can lead to unauthorized access to sensitive database information, including password hashes. Organizations using AVideo should prioritize patching this issue to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.