CVE-2019-12385

CVE-2019-12385 is a high-severity SQL Injection vulnerability affecting Ampache versions through 3.9.1. This flaw in the search engine allows any user, including guests, to extract sensitive data such as session information and hashed passwords from the database. The vulnerability has a CVSS score of 8.8 (High) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While the EPSS score is low and there is no known active exploitation, publicly available exploit code, or significant community discussion, the potential for full compromise of admin accounts, especially when combined with Ampache's weak password generation, makes it a significant risk.