PT-2019-15563 · Youphptube · Youphptube

Egidio Romano · Published 2019-11-02 · Updated 2019-12-16 · CVE-2019-18662

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouPHPTube versions through 7.7

Description An issue was discovered where user input passed through the live stream code parameter to the "/plugin/LiveChat/getChat.json.php" endpoint is not properly sanitized. This can be exploited by malicious users to read sensitive data from the database through in-band SQL Injection attacks. The exploitation of this issue requires the Live Chat plugin to be enabled.

Recommendations For YouPHPTube versions through 7.7, consider disabling the Live Chat plugin until a patch is available to prevent exploitation of this issue. Additionally, restrict access to the "/plugin/LiveChat/getChat.json.php" endpoint to minimize the risk of SQL Injection attacks. Avoid using the live stream code parameter in the affected endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-18662

Affected Products

Youphptube

References · 6

• https://github.com/YouPHPTube/YouPHPTube/issues/2202 · Patch
• https://osv.dev/vulnerability/CVE-2019-18662 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18662 · Security Note
• http://seclists.org/fulldisclosure/2019/Dec/9 · Note
• https://t.me/defcon_news/33044 · Telegram Post
• http://packetstormsecurity.com/files/155564/YouPHPTube-7.7-SQL-Injection.html · Note