OwnTone Server SQL Injection Vulnerability in DAAP Query and Filter Handling

A SQL injection vulnerability has been identified in OwnTone Server versions 28.4 prior to 29.1. This vulnerability arises in the handling of DAAP query and filter parameters, allowing attackers to inject arbitrary SQL expressions. The exploitation involves supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. The vulnerability is due to inadequate sanitization of these parameters, which can be exploited to bypass filters and gain unauthorized access to media library data.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate SQL queries to access or modify database information. In this case, it could lead to unauthorized access to media library data.

Remediation

Users can update to OwnTone Server version 29.1 or later, where this vulnerability has been patched.