CVE-2020-15153— Unauthenticated SQL injection in Ampache
Quick assessment
Affected
ampache ampache
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ampache是一款基于Web的音频/视频应用程序和文件管理器。 Ampache 4.2.2之前版本存在SQL注入漏洞，该漏洞允许未经身份验证的用户执行SQL注入。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-15153
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated SQL injection in Ampache
Source: CVE Program / CVE List V5
Vulnerability Description
Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for details and a workaround. This is fixed in version 4.2.2 and the development branch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Ampache SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ampache是一款基于Web的音频/视频应用程序和文件管理器。 Ampache 4.2.2之前版本存在SQL注入漏洞，该漏洞允许未经身份验证的用户执行SQL注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2020-15153
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15153
请登录查看更多情报信息。
Patches & Fixes for CVE-2020-15153 (1)
Vendor Advisories for CVE-2020-15153 (1)
-
https://github.com/ampache/ampache/security/advisories/GHSA-phr3-mpx5-7826 x_refsource_CONFIRM
Other References for CVE-2020-15153 (1)
-
https://github.com/ampache/ampache/releases/tag/4.2.2 x_refsource_MISC
IV. Related Vulnerabilities
Same product: ampache
-
CVE-2024-51484
Insufficient Validation in Controllers (Activation/Deactivat -
CVE-2024-51485
Insufficient Validation in Plugins (Activation/Deactivation) -
CVE-2024-51486
Stored Cross-Site Scripting in Ampache -
CVE-2024-51487
Insufficient Validation in Catalog (Activation/Deactivation) -
CVE-2024-51488
Insufficient Validation in Delete Message in Ampache
Same vendor: ampache
-
CVE-2024-51484
Insufficient Validation in Controllers (Activation/Deactivat -
CVE-2024-51485
Insufficient Validation in Plugins (Activation/Deactivation) -
CVE-2024-51486
Stored Cross-Site Scripting in Ampache -
CVE-2024-51487
Insufficient Validation in Catalog (Activation/Deactivation) -
CVE-2024-51488
Insufficient Validation in Delete Message in Ampache
Same weakness: CWE-89
-
CVE-2026-5048
Brocade SANnav 3.0.0a前版本存在SQL注入漏洞 -
CVE-2026-76270
Structured Query Language (SQL) Injection in the SPL2 Module -
CVE-2026-95605
WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vu -
CVE-2026-76452
Cisco Smart Software Manager On-Prem SQL Injection Vulnerabi -
CVE-2026-62251
Homer: Authenticated SQL Injection via Unvalidated rawquery
V. Comments for CVE-2020-15153
No comments yet