Vulnerability Spotlight: Multiple vulnerabilities in YouPHPTube

guest · Oct 17, 2019

Vulnerability Spotlight: Multiple vulnerabilities in YouPHPTube
October 17, 2019
https://blog.talosintelligence.com/2019/10/vuln-spotlight-php-tube-sql-vulns-oct-2019.html

YouPHPTube contains multiple vulnerabilities that could allow an attacker to carry out a variety of malicious activities. Specially crafted, attacker-created web requests can allow an attacker to inject SQL code into the application in some of these cases.

YouPHPTube is an open-source program that can allow users to create their own, custom video sites. The software is meant to mimic popular websites such as YouTube, Netflix and Vimeo, according to its website. If successful, an attacker could use these vulnerabilities to gain the ability to exfiltrate files in the database, steal user credentials and, in some configurations, access the underlying operating system.

In accordance with our coordinated disclosure policy, Cisco Talos worked with YouPHPTube to ensure that these issues are resolved and that an update is available for affected customers.
Versions tested
Researchers tested and confirmed that versions 6.2, 7.6 are affected by TALOS-2019-0908, TALOS-2019-0907 and TALOS-2019-0906, TALOS-2019-0909, TALOS-2019-0910 and TALOS-2019-0911. Version 7.6 is affected by TALOS-2019-0917.
Click to expand...

Log in or Sign up

Vulnerability Spotlight: Multiple vulnerabilities in YouPHPTube

guest Guest

Log in or Sign up

Vulnerability Spotlight: Multiple vulnerabilities in YouPHPTube

guest Guest

Useful Searches