CVE-2021-32644

MEDIUM

Cross-site Scripting in Random.php

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-32644 has a selected CVSS score of 6.4 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Affected products and versions

1
ProductSourceVersion range

ampache

Browse ampache / ampache
CVE List>= 4.0.0, < 4.4.3affected

Proofs of concept

1

Repository PoCs

GitHubdnr6419/CVE-2021-32644Repository PoCby dnr64190Not analyzed3 files

17.1 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

dnr6419/CVE-2021-32644Created Vuln labCVE-2021-32644Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining an Ampache 4.4.2 web application and a MySQL 5 database, intended to demonstrate CVE-2021-32644, a cross-site scripting vulnerability.

docker-compose.yml:1-21README.md:1-27

Lab assessment

Vulnerability lab

The README explicitly states the purpose is to demonstrate CVE-2021-32644, an XSS vulnerability in Ampache before 4.4.3, and provides a proof-of-concept URL. The Compose file sets up the vulnerable version 4.4.2.

README.md:1-3README.md:15-17docker-compose.yml:5
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

ampache

vulnerable web application

Runs Ampache 4.4.2, a web-based media server, exposed on host port 80. It is the target of the XSS proof-of-concept.

docker-compose.yml:4-10README.md:15-17

mysql

database backend

Provides MySQL 5 database service for Ampache, with root password set to '123456'. It is on the same network as Ampache.

docker-compose.yml:11-17
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-32644

Supported by supplied evidence

The README identifies the vulnerability as CVE-2021-32644, an XSS in Ampache before 4.4.3, and the Compose file uses the vulnerable version 4.4.2. The provided PoC URL targets the described XSS.

README.md:1-3README.md:15-17docker-compose.yml:5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.README.md:7
  • The Ampache instance must be installed and configured with the MySQL database as described.README.md:7-13

Evidence-described exercise path

  1. Start the Docker Compose environment with 'docker-compose up'.README.md:7
  2. Access the Ampache web interface at http://[web-server ip]:port/ and configure the MySQL database as shown in the screenshot.README.md:9-13
  3. Trigger the XSS vulnerability by visiting the provided PoC URL: http://[ip]:port/random.php?action=get_advanced&type=%27%22%20onmouseover%3dalert(0x0002DE)%20README.md:15-17
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The Compose file maps port 80, which is necessary to access the web application for the exercise. No privileged mode, host volume mounts, or other escape mechanisms are present. The PoC demonstrates an XSS within the lab's own target; there is no evidence of host compromise, external connections, persistence, or destructive behavior.

docker-compose.yml:1-21README.md:1-27
Review boundaries

What the analysis did not establish

  • The packet includes an uninspected binary file (attack.tar.gz) that is not analyzed; its contents and behavior are unknown.
  • The README references external images (screenshots) that are not included in the evidence.
  • The Compose file uses a hardcoded MySQL root password, which is a weak security practice but not inherently malicious in a lab context.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2