CVE-2021-25874
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A SQL Injection vulnerability in AVideo/YouPHPTube 10.0 and prior allows an unauthenticated remote attacker to inject SQL code via the catName parameter. This enables retrieval of database information, including application password hashes.
Risk Assessment
An attacker can access sensitive credential data, potentially leading to admin account takeover and further compromise of the infrastructure.
Recommendation
Immediately update AVideo/YouPHPTube to the latest available version and implement parameterized SQL queries to prevent injection attacks.
Other vulnerabilities in AVideo/YouPHPTube
See all- CVE-2021-25878Medium
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25877High
A vulnerability in AVideo/YouPHPTube 10.0 and prior allows insecure file writes. An administrator can write files to the filesystem using flag and code variables in save.php.
- CVE-2021-25876Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25875Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
Original NVD description (English source)
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes.