EdTv 2 contains a critical SQL injection vulnerability in the 'id' parameter that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can exploit this by sending GET requests to the admin/edit_source endpoint with crafted SQL UNION statements. The vulnerability enables extraction of sensitive database information including schema names, user credentials, and version details. This represents a high-severity security flaw that could lead to complete database compromise. The vulnerability affects EdTv version 2 and has been assigned CVE-2018-25171.