WWBN AVideo exposes a SQL injection flaw in the get.json.php endpoint when the APIName parameter is set to channels. The flaw allows an unauthenticated user to manipulate the sort column parameter to direct the database to sort by any column, including users.password and users.recoverPass. By observing the returned data or error messages, attackers can deduce password hash values, recovery tokens, and even trigger SQL errors that reveal the full query and database schema. This vulnerability compromises the confidentiality of user credentials, enabling credential theft or account takeover.

The vulnerability affects all deployments of WWBN AVideo using the get.json.php endpoint with APIName=channels, regardless of version. The vendor product is WWBN AVideo, and no specific version range is listed, so all current and legacy releases are potentially impacted.

OWASP CVSS score 8.7 marks it as High severity, and the vulnerability is exploitable by unauthenticated users through normal API traffic, meaning no privileged access or local execution is required. The EPSS score is not available, but elevated CVSS indicates significant potential. The exploit path is straightforward: send crafted requests to the sort column parameter; the similar ordering oracle can be used to glean hash values or force error output. The software is not listed in CISA's KEV catalog, but its impact on credential confidentiality warrants rapid patching. Attackers could leverage these disclosed tokens to account takeover or bypass password reset mechanisms.