CVE-2026-85155 in AVideo
Summary
by MITRE • 09/03/2026
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in WWBN AVideo represents a critical security flaw within its API infrastructure, specifically targeting the get.json.php endpoint when invoked with the channels API name. This issue stems from an improper neutralization of special elements used in SQL commands, commonly categorized under CWE-89 as Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). The root cause lies in the application's handling of the sort column parameter, which is passed directly into a database query without adequate sanitization or validation. This design oversight allows unauthenticated remote attackers to manipulate the structure of the underlying SQL statement by injecting arbitrary values for the sorting criteria. Unlike typical injection attacks that aim to extract data through UNION-based techniques, this specific vulnerability leverages an ordering oracle approach, where the application's response behavior reveals information about the database schema and content based on whether a sort operation succeeds or fails.
The operational impact of this flaw is severe due to its unauthenticated nature, meaning any external actor can exploit it without needing valid credentials. By manipulating the sort column parameter, attackers can attempt to order results by sensitive columns such as users.password and users.recoverPass. While these fields typically contain hashed values rather than plaintext passwords, the ability to influence how data is ordered allows for a sophisticated inference attack. If the database schema includes these password or recovery token columns in the result set of the channels query, the attacker can observe variations in response times or error messages to deduce information about these sensitive fields. This technique effectively turns the sorting mechanism into a side-channel that leaks confidential authentication data, potentially compromising user accounts and system integrity.
Furthermore, the vulnerability facilitates more direct forms of exploitation through SQL errors. When an invalid column name is provided for sorting, the database engine may return detailed error messages to the application layer, which are then exposed to the attacker. These verbose error responses can disclose the full structure of the executed SQL query as well as the underlying database schema. This disclosure provides attackers with a map of the database tables and columns, significantly lowering the barrier for further exploitation. With knowledge of the schema, an attacker could potentially craft more precise injection payloads or identify other vulnerable endpoints that rely on similar patterns. The combination of information leakage through error messages and data inference through ordering creates a powerful attack vector that undermines the confidentiality guarantees expected from the application's database layer.
Mitigation strategies must address both the immediate code flaw and broader architectural weaknesses. Developers should implement strict input validation for all parameters passed to SQL queries, ensuring that sort columns are restricted to a predefined whitelist of allowed column names rather than accepting arbitrary user input. Parameterized queries or prepared statements should be utilized wherever possible to separate data from logic, although this is particularly challenging with dynamic sorting clauses which often require string concatenation in many database drivers; therefore, whitelisting remains the most effective defense for such cases. Additionally, error handling mechanisms must be configured to suppress detailed SQL errors from being returned to end-users or API consumers. Generic error messages should be displayed instead of raw database exceptions, preventing schema disclosure and query structure leakage. Regular security audits and static code analysis tools focused on CWE-89 patterns can help identify similar vulnerabilities across the application's codebase before they are exploited in production environments.