CVE-2019-5128

🗓️ 25 Oct 2019 17:12:36Reported by talosType

cve🔗 web.nvd.nist.gov👁 180 Views🌐 WEB

A command injection found in YouPHPTube Encoder. Allows server compromise. Exploitable unauthenticated command injections in YouPHPTube Encoder 2.3. Vulnerable parameter: base64Url in /objects/getImageMP4.php

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2019-5128	29 Jan 202409:41	–	circl
CNVD	YouPHPTube Encoder Operating System Command Injection Vulnerability	28 Oct 201900:00	–	cnvd
Check Point Advisories	YouPHPTube Encoder Command Injection (CVE-2019-5127; CVE-2019-5128; CVE-2019-5129)	25 Feb 202000:00	–	checkpoint_advisories
Cvelist	CVE-2019-5128	25 Oct 201917:12	–	cvelist
Nuclei	YouPHPTube Encoder - Arbitrary File Write	3 Jun 202606:04	–	nuclei
NVD	CVE-2019-5128	25 Oct 201918:15	–	nvd
Prion	Command injection	25 Oct 201918:15	–	prion
RedhatCVE	CVE-2019-5128	5 Feb 202517:53	–	redhatcve
Talos	YouPHPTube Encoder base64Url multiple command injections	17 Oct 201900:00	–	talos
VulnCheck KEV	VulnCheck KEV: CVE-2019-5128	15 Nov 202300:00	–	vulncheck_kev

NVD

Vulners

Node

youphptube youphptube_encoderMatch2.3

[
  {
    "product": "YouPHPTube",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "YouPHPTube Encoder 2.3"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2019-0917

Parameter	Position	Path	Description	CWE
base64Url	query param	objects/getImageMP4.php	Command injection vulnerability in YouPHPTube Encoder: base64Url in /objects/getImageMP4.php allows unauthenticated remote command execution.	CWE-78

21 Nov 2024 04:44Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

CVSS 310

EPSS0.9306