CVE-2019-5150CWE-89

An exploitable SQL injection vulnerability exist in YouPHPTube 7.7

High · published October 31, 2019

CVSS v3.1
8.9
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.

The record
Technical detail
CVSS v3.1
8.9 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.01527 · 74.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2019-10-31T19:32Z
EPSS history
Timeline
  • 31 OCT 19:32Z
    An exploitable SQL injection vulnerability exist in YouPHPTube 7.7
    cvelistv5