Authenticated users can exploit a SQL injection vulnerability in WWBN AVideo to extract sensitive database contents, posing a significant risk to data confidentiality.

This is a time-based blind SQL injection flaw (CWE-89) occurring in the remindMe.json.php script. An authenticated attacker can supply a malicious live_schedule_id parameter that is concatenated into a SQL query, allowing for the unauthorized extraction of database information.

Successful exploitation allows an authenticated user to perform blind SQL injection, which can lead to the unauthorized disclosure of sensitive data stored within the application database. Given the CVSS score of 8.1, this is a high-severity issue that could result in significant data breaches and compromise of user information.

Immediate Action: Apply the fix provided in commit 75d45780728294ededa1e3f842f95295d3e7d144 immediately, as no official patched version beyond 26.0 is currently listed.

Proactive Monitoring: Review web access logs for unusual patterns or suspicious characters in the live_schedule_id parameter and monitor database query performance for potential time-based injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block SQL injection payloads targeting the remindMe.json.php endpoint.

Public Exploit Available: No (exploit_available unknown).

Organizations utilizing WWBN AVideo should prioritize this vulnerability due to the high-severity risk of data exfiltration. Since a specific version patch is not yet identified, administrators must apply the upstream fix commit directly or restrict access to the affected endpoint until a vendor-supported update is available.