Headline

CVE-2019-5120: TALOS-2019-0910 || Cisco Talos Intelligence Group

An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configurations, access the underlying operating system.

5 years ago

CVE

Open in Source

#sql #vulnerability #web #windows #cisco #js #java #intel #php #auth #firefox

Summary

Tested Versions

YouPHPTube 6.2
YouPHPTube 7.6
YouPHPTube 7.7 commit 64d35de96e43c5e5b3d582162c12b86eec7e986b (Oct 1st 2019)

Product URLs

https://www.youphptube.com/

CVSSv3 Score

7.4 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)

Details

A SQL injection vulnerability exists in YouPHPTube 7.6. A successful attack could allow an attacker to access information such as usernames and password hashes that are stored in the database.

The /objects/playlistAddNew.json.php URL and parameter id have been confirmed to suffer from a SQL injection and could be exploited by authenticated attackers:

Parameter id in /plugin/AD_Server/view/campaignsVideos.json.php :

POST /plugin/AD_Server/view/campaignsVideos.json.php HTTP/1.1
Host: [IP]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://[IP]/plugin/AD_Server/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 3
DNT: 1
Connection: close
Cookie: PHPSESSID=[SESSIONID]

id=[SQL INJECTION]

Timeline

2019-09-20 - Vendor Disclosure
2019-10-16 - Vendor Patched
2019-10-17 - Public Release

Discovered by Yuri Kramarz of Security Advisory EMEAR.