Ampache 6.5.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability. This vulnerability exists in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions can set the Name field to
Details
The vulnerability is due to insufficient filtering of the $title variable in the /public/templates/show_box_top.inc.php file.
Vulnerable Code:
<?php
declare(strict_types=0);
/**
* vim:set softtabstop=4 shiftwidth=4 expandtab:
*
* LICENSE: GNU Affero General Public License, version 3 (AGPL-3.0-or-later)
* Copyright Ampache.org, 2001-2023
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
*/
$class = $class ?? 'box';
$title = $title ?? ''; ?>
<div class="<?php echo $class; ?>">
<div class="box-inside">
<div class="box-top">
<div class="box-left-top"></div>
<div class="box-right-top"></div>
</div>
<?php if ($title) { ?>
<h3 class="box-title"><?php echo $title; ?></h3>
<?php } ?>
<div class="box-content clearfix">
PoC
The following HTTP request demonstrates the exploitation of this vulnerability.
An attacker with Content Manager permissions can exploit this vulnerability to obtain the cookies of any user or administrator who accesses the democratic.php file.
Summary
Ampache 6.5.0 is vulnerable to a stored cross-site scripting (XSS) vulnerability. This vulnerability exists in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions can set the Name field to
Details
The vulnerability is due to insufficient filtering of the $title variable in the
/public/templates/show_box_top.inc.php
file. Vulnerable Code:PoC
The following HTTP request demonstrates the exploitation of this vulnerability.
Impact
An attacker with Content Manager permissions can exploit this vulnerability to obtain the cookies of any user or administrator who accesses the democratic.php file.![image](https://github.com/ampache/ampache/assets/66168888/c6e11948-50f2-4b38-8a32-a2814f30b789)