CVE-2020-15311

Name of the Vulnerable Software and Affected Versions Stash version 1.0.3

Description The issue allows SQL Injection via the downloadmp3.php API endpoint, specifically through the download parameter.

Recommendations For Stash version 1.0.3, consider restricting access to the downloadmp3.php endpoint until a patch is available. As a temporary workaround, avoid using the download parameter in the affected endpoint to minimize the risk of exploitation.