PT-2019-17489 · Youphptube · Youphptube

Publicado 2019-10-25 · Atualizado 2022-07-17 · CVE-2019-5120

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6

Description An exploitable SQL injection issue exists in the authenticated part of the software. Specially crafted web requests can cause SQL injections, potentially allowing exfiltration of the database and user credentials. In certain configurations, this could also provide access to the underlying operating system.

Recommendations For YouPHPTube version 7.6, consider restricting access to authenticated parts of the application until a fix is available, and avoid using parameters that could contain SQL injection attacks in web requests. As a temporary workaround, consider implementing additional validation and sanitization for user input to minimize the risk of exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-5120

Produtos afetados

Youphptube

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0910 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5120 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5120 · Nota de Segurança