WWBN AVideo CVE-2026-85155

No authentication is required and no special server-side configuration is needed beyond a default AVideo deployment with the channels API endpoint publicly accessible. The attack requires only network access to the AVideo instance and the ability to send HTTP GET requests with a crafted sort parameter. Error-based schema disclosure additionally requires the PHP/MySQL stack to return verbose database error messages, which is typical in default configurations. The ordering oracle technique is slower than union-based or time-based SQLi but is fully automatable and requires no prior knowledge of the database schema. Exploitation is read-only: no write capability or code execution via this parameter is described, and the impact is limited to confidentiality of users.password hashes, users.recoverPass tokens, and database schema structure.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) is well-calibrated to the described impact: remote, unauthenticated, low-complexity access yielding high confidentiality loss with no integrity or availability impact. The attack is not instantaneous - the ordering oracle requires many sequential HTTP requests to reconstruct a full hash - but this is fully automatable via sqlmap or custom scripts, making it effectively scalable. The most dangerous extracted data is users.recoverPass (recovery tokens), which may allow direct account takeover without requiring offline hash cracking. No EPSS data or CISA KEV listing is present in the input; exploitation is not confirmed as active. However, the accessible, unauthenticated attack surface and the direct path to credential material make this a real operational priority for any publicly exposed AVideo deployment. The primary limiting factor is read-only impact: this vector does not demonstrate direct write access or code execution.

An unauthenticated attacker sends a series of crafted GET requests to get.json.php?APIName=channels&sort=users.password, observing the ordering of returned channel rows to binary-search password hash characters one at a time - the ordering oracle technique. Simultaneously, intentionally malformed sort values such as sort=1 appended with SQL syntax elicit full query error messages that expose the database schema. After reconstructing password hashes and recovery tokens across hundreds of automated requests, the attacker either cracks weak hashes offline or directly redeems the recoverPass tokens to reset and hijack administrator or user accounts.