PT-2019-17500 · Youphptube · Youphptube

Publicado 2019-10-31 · Atualizado 2022-06-27 · CVE-2019-5150

Positive Technologies (AI Summary)

CVSS v3.1

8.9

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.7

Description An exploitable SQL injection issue exists when the VideoTags plugin is enabled. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database, and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this issue.

Recommendations For YouPHPTube version 7.7, disable the VideoTags plugin until a patch is available to prevent potential exploitation.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-5150

Produtos afetados

Youphptube

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0940 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5150 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5150 · Nota de Segurança