Stored XSS in Ampache LocalPlay Functionality Exposes Admin Credentials

CVE-2019-12386

What is CVE-2019-12386?

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Ampache, specifically affecting the LocalPlay functionality. When an attacker exploits this vulnerability, they can inject malicious code through the 'add instance' feature in localplay.php. This code is then reflected in the instances menu, potentially allowing the attacker to manipulate the system. A successful attack could compel an admin to unwittingly create a new privileged user, granting the attacker unauthorized access to system resources with known credentials.

References