WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` through multiple functions without sanitization until it reaches `Scheduler_commands::getAllActiveOrToRepeat()`, which directly concatenates it into a SQL `LIKE` clause. Although intermediate functions (`new Live_schedule()`, `getUsers_idOrCompany()`) apply `intval()` internally, they do so on local copies within `ObjectYPT::getFromDb()`, leaving the original tainted variable unchanged. Any authenticated user can perform time-based blind SQL injection to extract arbitrary database contents. Commit 75d45780728294ededa1e3f842f95295d3e7d144 contains a patch.

Affected: Packagist: wwbn/avideo

## Summary

The `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` through multiple functions without sanitization until it reaches `Scheduler_commands::getAllActiveOrToRepeat()`, which directly concatenates it into a SQL `LIKE` clause. Although intermediate functions (`new Live_schedule()`, `getUsers_idOrCompany()`) apply `intval()` internally, they do so on local copies within `ObjectYPT::getFromDb()`, leaving the original tainted variable unchanged. Any authenticated user can perform time-based blind SQL injection to extract arbitrary database contents.

## Details

The vulnerability involves a 6-step data flow from user input to an unsanitized SQL sink:

**Step 1 — User input (no sanitization):** `plugin/Live/remindMe.json.php:15`: ```php $reminder = Live::setLiveScheduleReminder($_REQUEST['live_schedule_id'], ...); ```

**Step 2 — Auth check passes for any user:** `plugin/Live/Live.php:4126`: ```php if (!User::isLogged()) { $obj->msg = __('Must be logged'); return $obj; } ```

**Step 3 — intval() applied only internally, original variable unchanged:** `plugin/Live/Live.php:4141-4143`: ```php $ls = new Live_schedule($live_schedule_id); // intval() inside getFromDb() only $users_id = Live_schedule::getUsers_idOrCompany($live_schedule_id); // same ```

`objects/Object.php:84` (inside `getFromDb()`): ```php $id = intval($id); // sanitizes the LOCAL parameter, not the caller's variable ```

With input like `1" AND SLEEP(5) --`, `intval()` extracts…