CyberRota Analysis
AI-GeneratedThe vulnerability affects Oracle's WWBN AVideo, specifically in the sort column parameter of the get.json.php endpoint, allowing unauthenticated attackers to manipulate database queries. This SQL injection can lead to the exposure of sensitive information, such as password hashes and recovery tokens, as well as detailed database schema information. Organizations using this software should prioritize remediation to mitigate the risk of unauthorized data access and potential credential compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.