CVE-2019-12385 in Ampache
Summary
by MITRE
An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/01/2023
The vulnerability identified as CVE-2019-12385 represents a critical SQL injection flaw within the Ampache media server software version 3.9.1 and earlier. This security weakness resides in the search functionality implemented through the lib/class/search.class.php component, which processes user input without adequate sanitization or parameterization. The flaw allows attackers to manipulate database queries through crafted search parameters, potentially enabling unauthorized access to sensitive information stored within the application's backend database system. The vulnerability affects all user roles including unauthenticated guest users, significantly expanding the attack surface and making it particularly dangerous for systems where guest access is permitted.
The technical exploitation of this vulnerability occurs through the improper handling of user-supplied search terms within the application's database query construction logic. When users submit search queries to the system, the input values are directly incorporated into SQL statements without proper validation or escaping mechanisms. This creates an environment where malicious actors can inject additional SQL commands that bypass normal authentication and authorization checks. The vulnerability maps directly to CWE-89 which classifies SQL injection as a weakness that occurs when an application fails to properly sanitize user input before incorporating it into SQL queries, making it one of the most prevalent and dangerous web application security flaws.
The operational impact of this vulnerability extends far beyond simple data exposure, as it can lead to complete system compromise when combined with other weaknesses present in the application. Attackers who successfully exploit this SQL injection can extract session information, hashed passwords, user credentials, and other sensitive database contents that could provide unauthorized access to administrative accounts. The security implications are compounded by the presence of a weak password generator algorithm in the lostpassword functionality, which when combined with the exposed password hashes could enable attackers to easily compromise admin accounts. This combination creates a scenario where even a guest user could potentially escalate privileges and gain full administrative control over the media server.
The exploitation of this vulnerability aligns with several tactics described in the MITRE ATT&CK framework, particularly those related to credential access and privilege escalation. The initial exploitation through SQL injection corresponds to technique T1078 which covers valid accounts and T1212 which involves exploitation of remote services. The subsequent compromise of administrative accounts through exposed credentials demonstrates the progression from initial access to persistent access. Organizations using Ampache versions prior to 3.9.2 should immediately implement mitigations including input validation, parameterized queries, and proper access controls. The recommended remediation involves upgrading to the patched version of Ampache, implementing web application firewall rules to detect and block malicious search parameters, and conducting thorough security audits to identify any potential compromise of user credentials or session data. Additionally, organizations should review their password policies and consider implementing multi-factor authentication to reduce the impact of credential compromise.