CVE-2019-12385: SQL Injection
An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12385?
CVE-2019-12385 is considered a critical vulnerability due to its potential for complete database compromise.
How do I fix CVE-2019-12385?
To fix CVE-2019-12385, upgrade Ampache to version 3.9.2 or later to mitigate the SQL Injection vulnerability.
Who is affected by CVE-2019-12385?
All users of Ampache versions up to and including 3.9.1 are affected by CVE-2019-12385, including guest users.
What type of vulnerability is CVE-2019-12385?
CVE-2019-12385 is classified as a SQL Injection vulnerability that can lead to unauthorized access to sensitive data.
What data can be exposed due to CVE-2019-12385?
CVE-2019-12385 can expose sensitive data including session information and hashed passwords from the database.