Description
An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to perform lib/class/search.class.php searches (even guest users) can dump any data contained in the database (sessions, hashed passwords, etc.). This may lead to a full compromise of admin accounts, when combined with the weak password generator algorithm used in the lostpassword functionality.
Remediation
References
Related Vulnerabilities
MySQL Other Vulnerability (CVE-2004-0388)
WordPress Plugin WordPress Video Player Cross-Site Scripting (1.5.1)
WordPress Plugin Media Tags Cross-Site Scripting (3.2.0.2)
WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.26)
WordPress Plugin Redux Framework Multiple Cross-Site Scripting Vulnerabilities (3.6.0.2)