PT-2019-15563 · Youphptube · Youphptube

Egidio Romano · Publicado 2019-11-02 · Atualizado 2019-12-16 · CVE-2019-18662

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouPHPTube versions through 7.7

Description An issue was discovered where user input passed through the live stream code parameter to the "/plugin/LiveChat/getChat.json.php" endpoint is not properly sanitized. This can be exploited by malicious users to read sensitive data from the database through in-band SQL Injection attacks. The exploitation of this issue requires the Live Chat plugin to be enabled.

Recommendations For YouPHPTube versions through 7.7, consider disabling the Live Chat plugin until a patch is available to prevent exploitation of this issue. Additionally, restrict access to the "/plugin/LiveChat/getChat.json.php" endpoint to minimize the risk of SQL Injection attacks. Avoid using the live stream code parameter in the affected endpoint until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-18662

Produtos afetados

Youphptube

Referências · 6

• https://github.com/YouPHPTube/YouPHPTube/issues/2202 · Correção
• http://seclists.org/fulldisclosure/2019/Dec/9 · Nota
• https://osv.dev/vulnerability/CVE-2019-18662 · Aviso do Fabricante
• https://t.me/defcon_news/33044 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-18662 · Nota de Segurança
• http://packetstormsecurity.com/files/155564/YouPHPTube-7.7-SQL-Injection.html · Nota