PT-2019-17486 · Youphptube · Youphptube

Yuri Kramarz · Publicado 2019-10-25 · Atualizado 2022-07-19 · CVE-2019-5116

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6

Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this issue, potentially allowing exfiltration of the database, user credentials, and in certain configurations, access to the underlying operating system.

Recommendations For YouPHPTube version 7.6, consider restricting access to authenticated parts of the application until a patch is available. As a temporary workaround, avoid using parameters that may contain SQL injection attacks in web requests. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-5116

Produtos afetados

Youphptube

Referências · 4

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0907 · Exploit
• https://t.me/cvenotify/33376 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-5116 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5116 · Nota de Segurança