Readymade Video Sharing Script 3.2 - 'search' SQL Injection

Exploit Title: Readymade Video Sharing Script - SQL Injection Error Based Google Dork: NA Date: 10.02.2018 Exploit Author: Varun Bagaria Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/ Version: 3.2 Tested on: Windows...

CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

CVE-2017-17892: Improper Neutralization of Special Elements used in an SQL Command

Readymade Video Sharing Script has SQL Injection via the viewsubs.php chnlid parameter or the searchvideo.php search parameter...

CVE-2017-17893: Improper Neutralization of Input During Web Page Generation

Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...

CVE-2017-17891: Cross-Site Request Forgery (CSRF)

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

CVE-2017-17893

The following CVE concerns the Readymade Video Sharing Script (PHP Scripts Mall). It has a stored/reflected Cross‑Site Scripting (XSS) vulnerability exploitable via user input parameters: search_video.php using the search parameter, viewsubs.php using the chnlid parameter, and user-profile-edit.p...

CVE-2017-17891

CVE-2017-17891 affects Readymade Video Sharing Script. The vulnerability is a cross-site request forgery (CSRF) in the user-profile-edit.php endpoint. According to CNVD-2018-01938 and corroborating sources, a remote attacker can lure a logged‑in user to trigger changes to sensitive settings via t...

CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

CVE-2017-17892

The CVE-2017-17892 entry refers to Readymade Video Sharing Script with an SQL Injection vulnerability exposed through viewsubs.php?chnlid and search_video.php?search. Multiple connected sources confirm this vulnerability exists in the Readymade Video Sharing Script and detail the injection vector...

PT-2017-15077

Name of the Vulnerable Software and Affected Versions Readymade Video Sharing Script affected versions not specified Description The issue is related to SQL Injection, which can occur via the chnlid parameter in the "viewsubs.php" endpoint or the search parameter in the "search video.php" endpoin...

PT-2017-15078

Name of the Vulnerable Software and Affected Versions Readymade Video Sharing Script affected versions not specified Description The issue concerns the presence of a cross-site scripting XSS flaw. This flaw can be exploited through specific parameters in various PHP files, including the search...

PT-2017-15076

Name of the Vulnerable Software and Affected Versions Readymade Video Sharing Script affected versions not specified Description The issue concerns a CSRF vulnerability in the user-profile-edit.php file. Recommendations At the moment, there is no information about a newer version that contains a...

CVE-2017-17649

Readymade Video Sharing Script 3.2 is affected by an HTML Injection vulnerability in the single-video-detail.php comment parameter. The root cause is unvalidated input reflected into HTML, enabling injection of markup. Affected component: Readymade Video Sharing Script 3.2 (PHP Scripts Mall). Rep...

PT-2017-14942

Name of the Vulnerable Software and Affected Versions Readymade Video Sharing Script version 3.2 Description The issue concerns HTML Injection via the comment parameter in the "single-video-detail.php" endpoint. Recommendations For Readymade Video Sharing Script version 3.2, consider restricting...

CVE-2017-17649: Improper Control of Generation of Code

Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter...

Readymade Video Sharing Script 3.2 - HTML Injection

Readymade Video Sharing Script 3.2 - HTML Injection Exploit Title: Readymade Video Sharing Script 3.2 - HTML Injection Dork: N/A Date: 13.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/ Demo:...

CVE-2017-17627

The CVE-2017-17627 vulnerability affects Readymade Video Sharing Script 3.2, where SQL injection is possible in the single-video-detail.php endpoint via the report_videos array parameter. Multiple connected sources confirm a remote SQL injection vulnerability (CNVD-2017-37425, NVD entry) with rem...

CVE-2017-17627: Improper Neutralization of Special Elements used in an SQL Command

Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php reportvideos array parameter...

PT-2017-14923

Name of the Vulnerable Software and Affected Versions Readymade Video Sharing Script version 3.2 Description The issue concerns a SQL Injection vulnerability. It occurs via the report videos array parameter in the "single-video-detail.php" API endpoint. Recommendations For Readymade Video Sharing...

Readymade Video Sharing Script 3.2 SQL Injection

Exploit Title: Readymade Video Sharing Script 3.2 - SQL Injection Dork: N/A Date: 09.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/ Version: 3.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A...