CVE-2026-85155 Details
Description
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.
A SQL injection vulnerability has been identified in WWBN AVideo, specifically in the sort column parameter of the get.json.php endpoint when APIName is set to channels. This vulnerability allows unauthenticated attackers to manipulate the sorting of results by arbitrary database columns, including sensitive information such as password hashes and recovery tokens. Exploitation of this vulnerability not only facilitates unauthorized access to this sensitive data but also triggers SQL errors that reveal the full query statement and database schema.
To address this vulnerability, the sort column should be constrained to a predefined allowlist of safe columns. This can be implemented by modifying the BootGrid::getSqlFromPost() function to include an allowlist check, and updating the Channel::getChannels() method to declare and allow only specific sortable columns.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-pmmj-6425-gpgh | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-pmmj-6425-gpgh | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/wwbn-avideo-sql-injection-via-get-json-php-apiname-channels | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |