PT-2019-17488 · Youphptube · Youphptube

Publicado 2019-10-25 · Atualizado 2022-07-17 · CVE-2019-5119

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6

Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, potentially allowing an attacker to exfiltrate the database, obtain user credentials, and in certain configurations, access the underlying operating system.

Recommendations For YouPHPTube version 7.6, consider restricting access to authenticated parts of the application until a fix is available, and avoid using user-inputted parameters in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-5119

Produtos afetados

Youphptube

Referências · 3

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0909 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5119 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-5119 · Aviso do Fabricante