PT-2019-17485 · Youphptube · Youphptube

Yuri Kramarz · Published 2019-10-25 · Updated 2022-09-10 · CVE-2019-5114

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouPHPTube version 7.6

Description An exploitable SQL injection issue exists in the authenticated portion of the software. Specially crafted web requests can cause SQL injections, potentially allowing exfiltration of the database and user credentials. In certain configurations, this could also provide access to the underlying operating system.

Recommendations For YouPHPTube version 7.6, consider restricting access to authenticated portions of the software until a fix is available, and avoid using parameters that could contain SQL injection attacks in web requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-5114

Affected Products

Youphptube

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2019-0906 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5114 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5114 · Vendor Advisory