Description

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-03T13:06:22.210Z",
  "pubdate": "2026-09-03T13:06:22.210Z",
  "executiveSummary": "WWBN AVideo contains a critical SQL injection vulnerability within its get.json.php endpoint. This flaw allows unauthenticated remote attackers to perform unauthorized database queries by manipulating the 'sort' column parameter when APIName is set to 'channels'.\nThe vulnerability manifests as an ordering-based SQL injection, which an attacker can leverage as an oracle to infer sensitive data, such as password hashes and recovery tokens, from the database. Furthermore, improper error handling allows the application to leak full query statements and database schema details upon the execution of malformed inputs.\nThis vulnerability poses a significant risk to the confidentiality and integrity of the application, as it provides an unauthenticated actor with a vector to exfiltrate administrative credentials or gain unauthorized insights into the system's underlying data structure. Successful exploitation does not require prior authentication, making it a high-priority concern for any environment hosting the affected product.",
  "technicalDetails": "The vulnerability resides in the get.json.php endpoint of the WWBN AVideo platform. Specifically, the application fails to adequately sanitize or parameterize input provided to the 'sort' parameter when the 'APIName' is set to 'channels'. This allows for the injection of arbitrary SQL syntax directly into the ORDER BY clause of the generated database query.\nThe root cause is the improper handling of user-supplied data in dynamic SQL construction, which deviates from secure coding practices that require parameterized queries or strict allow-listing for dynamic identifiers such as column names.\nThe attack flow proceeds as follows: An unauthenticated attacker sends a crafted HTTP request to get.json.php with the parameters APIName=channels and a maliciously constructed 'sort' argument. By injecting conditional logic or subqueries into this parameter, the attacker forces the database to return results based on binary conditions regarding the content of sensitive tables, such as the 'users' table.\nBecause the application reflects database error messages when queries fail, an attacker can intentionally trigger syntax errors to extract the full structure of the underlying SQL query, including table names and column headers. This information disclosure significantly lowers the barrier for constructing more complex injection payloads.\nThe exploitation of the ordering oracle involves observing differences in the application's response when the results are sorted by different conditions. For example, an attacker can use techniques analogous to time-based or boolean-based blind SQL injection to infer the contents of the 'password' and 'recoverPass' columns, character by character. If the injected condition is true, the database orders the output in a specific way; if false, it orders it differently. By iterating through possible character values, the attacker can reconstruct hashed credentials and password recovery tokens for administrator accounts.\nThis vulnerability effectively bypasses any existing authentication controls, as the injection point is processed prior to session validation. The impact is severe, facilitating credential harvesting and enabling subsequent unauthorized access to the administrative dashboard or backend infrastructure. The attack is executable over the network with no special privileges, and the error-based component of the vulnerability allows for efficient mapping of the application's database schema."
}