Threats tagged 'ghsa-fhcc-7j5h-5hf8'

OwnTone Server versions through 29.3 have an SQL injection vulnerability in the mpd_sticker_find() function within src/mpd.c. This flaw allows unauthenticated remote attackers to inject SQL commands via the URI argument. Exploitation involves sending a crafted 'sticker find song' command to the MPD listener on TCP port 6600, enabling attackers to bypass path restrictions and enumerate all media files along with their filesystem paths and metadata.