CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
39.3%
Exploitable SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and,in certain configuration, access the underlying operating system.
YouPHPTube 6.2
YouPHPTube 7.6
YouPHPTube 7.7 commit 64d35de96e43c5e5b3d582162c12b86eec7e986b (Oct 1st 2019)
<https://www.youphptube.com/>
7.4 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (βSQL Injectionβ)
SQL injections have been found and confirmed within YouPHPTube 7.6. A successful attack could allow an attacker to access information such as usernames and password hashes that are stored in the database.
The /objects/pluginSwitch.json.php
URL and parameters uuid
, name
and dir
have been confirmed to suffer from SQL injections and could be exploited by authenticated attackers:
uuid
in /objects/pluginSwitch.json.php
:POST /YouPHPTube/objects/pluginSwitch.json.php HTTP/1.1
Host: [HOSTNAME].com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 82
DNT: 1
Connection: close
Referer: http://[HOSTNAME].com/YouPHPTube/plugins
Cookie: PHPSESSID=[SESSIONID]; rememberme=1; user=admin; pass=[COOKIE]; autoplay=true
uuid=[SQL Injection]&name=AD_Server&dir=AD_Server&enable=true
name
in /objects/pluginSwitch.json.php
:POST /YouPHPTube/objects/pluginSwitch.json.php HTTP/1.1
Host: [HOSTNAME].com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 82
DNT: 1
Connection: close
Referer: http://[HOSTNAME].com/YouPHPTube/plugins
Cookie: PHPSESSID=[SESSIONID]; rememberme=1; user=admin; pass=[COOKIE]; autoplay=true
uuid=[UID]&name=[SQL Injection]&dir=AD_Server&enable=true
dir
in /objects/pluginSwitch.json.php
:POST /YouPHPTube/objects/pluginSwitch.json.php HTTP/1.1
Host: [HOSTNAME].com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 82
DNT: 1
Connection: close
Referer: http://[HOSTNAME].com/YouPHPTube/plugins
Cookie: PHPSESSID=[SESSIONID]; rememberme=1; user=admin; pass=[COOKIE]; autoplay=true
uuid=[UID]&name=AD_Server&dir=AD_Server[SQL Injection]&enable=true
2019-09-19 - Vendor Disclosure
2019-10-16 - Vendor Patched
2019-10-17 - Public Release
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
39.3%