CVE-2021-45255

Name of the Vulnerable Software and Affected Versions: Video Sharing Website version 1.0

Description: The email parameter from the ajax.php endpoint of the Video Sharing Website appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.

Recommendations: For Video Sharing Website version 1.0, consider disabling the ajax.php endpoint or restricting access to the email parameter to minimize the risk of exploitation until a patch is available. Avoid using the email parameter in the affected endpoint until the issue is resolved.