CVE-2022-4665 (PHP, published 2022-12-23T01:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/ampache/ampache
Files changed:
docs/CHANGELOG.md
public/templates/show_artist_info.inc.php
resources/sql/ampache.sql
src/Module/Art/Collector/FolderCollectorModule.php
src/Module/Playback/Localplay/Mpd/AmpacheMpd.php
src/Module/Playback/Localplay/Upnp/UPnPDevice.php
src/Module/Playback/Localplay/Vlc/VlcPlayer.php
src/Module/Playback/Stream_Playlist.php
src/Module/System/Update.php
src/Repository/Model/Art.php
src/Repository/Model/Catalog.php
src/Repository/Model/TVShow_Season.php
src/Repository/Model/Tag.php
src/Repository/Model/User.php
Commit message: think we good now


Vulnerable code:
    <?php if (array_key_exists('summary', $biography) && !empty(trim($biography['summary']))) { ?>
        <?php echo nl2br($biography['summary']); ?>
        // Array of valid extensions
        $image_extensions = [
            'bmp',
            'gif',
            'jp2',
            'jpeg',
            'jpg',
            'png'
        ];

                if (!in_array($extension, $image_extensions)) {






                $new_pic       = array('data' => $source, 'mime' => $mime,
                    'picturetypeid' => $current_picturetypeid, 'description' => $description);
                                $ndata['attached_picture'][] = array('data' => $apics[0]['data'], 'description' => $apics[0]['description'],
                                    'mime' => $apics[0]['mime'], 'picturetypeid' => $apics[0]['picturetypeid']);
                                $ndata['attached_picture'][$apicsId]  = array('data' => $apics[$apicsId]['data'], 'mime' => $apics[$apicsId][$apic_mimetype],
                                'picturetypeid' => $apics[$apicsId][$apic_typeid], 'description' => $apics[$apicsId]['description']);
            $minw = (AmpConfig::get('album_art_min_width')) ? AmpConfig::get('album_art_min_width') : 0;
            $maxw = (AmpConfig::get('album_art_max_width')) ? AmpConfig::get('album_art_max_width') : 0;
            $minh = (AmpConfig::get('album_art_min_height')) ? AmpConfig::get('album_art_min_height') : 0;
            $maxh = (AmpConfig::get('album_art_max_height')) ? AmpConfig::get('album_art_max_height') : 0;
     * @param string $name
    private static function read_from_images($name = 'blankalbum.png')
            if (Core::get_global('user')->has_access(50) || (Core::get_global('user')->has_access(25) && Core::get_global('user')->id == $libitem->get_user_owner())) {
            $sql = "SELECT COUNT(`tvshow_episode`.`id`) AS `episode_count`, `video`.`catalog` AS `catalog_id` FROM `tvshow_episode` LEFT JOIN `video` ON `video`.`id` = `tvshow_episode`.`id` WHERE `tvshow_episode`.`season` = ?GROUP BY `catalog_id`";
        $sql   = "SELECT `tag_map`.`id`, `tag_map`.`tag_id`, `tag`.`name`, `tag_map`.`user` FROM `tag` LEFT JOIN `tag_map` ON `tag_map`.`tag_id`=`tag`.`id` WHERE `tag`.`is_hidden` = false AND `tag_map`.`object_type` = ? AND `tag_map`.`object_id` = ?LIMIT $limit";


            $image_data     = Art::get_from_source($upload, 'user');

Fixed code:
* Display webp images
* Check for a valid image extensions when uploading art
    <?php if (array_key_exists('summary', $biography) && !empty($biography['summary'])) { ?>
        <?php echo nl2br(trim($biography['summary'])); ?>
-- Generation Time: Dec 08, 2022 at 08:40 AM
-- Database: `ampache556`
                if (!in_array($extension, Art::VALID_TYPES)) {
    public const VALID_TYPES     = array('bmp', 'gif', 'jp2', 'jpeg', 'jpg', 'png', 'webp');
                $new_pic       = array(
                    'data' => $source,
                    'mime' => $mime,
                    'picturetypeid' => $current_picturetypeid,
                    'description' => $description
                );
                                $ndata['attached_picture'][] = array(
                                    'data' => $apics[0]['data'],
                                    'description' => $apics[0]['description'],
                                    'mime' => $apics[0]['mime'],
                                    'picturetypeid' => $apics[0]['picturetypeid']
                                );
                                $ndata['attached_picture'][$apicsId]  = array(
                                    'data' => $apics[$apicsId]['data'],
                                    'mime' => $apics[$apicsId][$apic_mimetype],
                                    'picturetypeid' => $apics[$apicsId][$apic_typeid],
                                    'description' => $apics[$apicsId]['description']
                                );
            $minw = AmpConfig::get('album_art_min_width', 0);
            $maxw = AmpConfig::get('album_art_max_width', 0);
            $minh = AmpConfig::get('album_art_min_height', 0);
            $maxh = AmpConfig::get('album_art_max_height', 0);
    private static function read_from_images()
            case 'webp':
                imagewebp($thumbnail);
                $mime_type = image_type_to_mime_type(IMAGETYPE_WEBP);
                break;
            if ((!empty(Core::get_global('user')) && Core::get_global('user')->has_access(50)) || (Core::get_global('user')->has_access(25) && Core::get_global('user')->id == $libitem->get_user_owner())) {

            $sql = "SELECT COUNT(`tvshow_episode`.`id`) AS `episode_count`, `video`.`catalog` AS `catalog_id` FROM `tvshow_episode` LEFT JOIN `video` ON `video`.`id` = `tvshow_episode`.`id` WHERE `tvshow_episode`.`season` = ? GROUP BY `catalog_id`";
        $sql   = "SELECT `tag_map`.`id`, `tag_map`.`tag_id`, `tag`.`name`, `tag_map`.`user` FROM `tag` LEFT JOIN `tag_map` ON `tag_map`.`tag_id`=`tag`.`id` WHERE `tag`.`is_hidden` = false AND `tag_map`.`object_type` = ? AND `tag_map`.`object_id` = ? LIMIT $limit";
            if (!in_array(strtolower($path_info['extension']), Art::VALID_TYPES)) {
                return false;
            }
            $image_data = Art::get_from_source($upload, 'user');