Sql injection

SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop...

CVE-2023-0771

CVE-2023-0771 affects the Ampache project (ampache/ampache) prior to version 5.5.7. The issue is a SQL Injection in the web application, arising from the underlying code as described across multiple sources, with impact stated as high for confidentiality, integrity, and availability. The document...

CVE-2022-4665

Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6...

SQL Injection in ampache/ampache

Description The application does not validate and escape the type parameter before using it in a SQL statement in Model/Tag.php, leading to a SQL Injection Proof of Concept Time delay: GET /browse.php?action=tag&type=0%27orifnow=sysdate,sleep3,0or%27 HTTP/1.1 Host: demo.ampache.dev sec-ch-ua:...