PT-2019-17490
CVE-2019-5121
·
تاريخ النشر
2019-10-25
·
تاريخ التحديث
2022-07-17
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
YouPHPTube version 7.6
Description
The issue allows for SQL injection attacks in the authenticated section of the software. An attacker can craft special web requests to inject SQL code, potentially exploiting the
uuid parameter in the "/objects/pluginSwitch.json.php" API endpoint.Recommendations
For YouPHPTube version 7.6, consider restricting access to the "/objects/pluginSwitch.json.php" API endpoint until a patch is available, and avoid using the
uuid parameter in this endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾