10.0crit
CVE-2019-5151
An exploitable SQL injection vulnerability exist in YouPHPTube 7.7.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
10.0
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
2.3%
percentile 83%
Public exploits
0
none known
Summary
An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.
Exploit prediction (EPSS)
2.27% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H |
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a YouPHPTube
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- talosintelligence.com /vulnerability_reports/TALOS-2019-0941 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-5151
- NVD: CVE-2019-5151
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.