CVE-2021-25877
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
A vulnerability in AVideo/YouPHPTube 10.0 and prior allows insecure file writes. An administrator can write files to the filesystem using flag and code variables in save.php.
Risk Assessment
The risk involves the ability for a privileged administrator to write malicious files, potentially leading to privilege escalation or server compromise.
Recommendation
Immediately update to the latest version of AVideo/YouPHPTube and restrict administrator privileges to the minimum necessary.
Other vulnerabilities in AVideo/YouPHPTube
See all- CVE-2021-25878Medium
AVideo/YouPHPTube 10.0 and prior versions are affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the videoName parameter. This allows a remote attacker to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25876Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.
- CVE-2021-25875Medium
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.
- CVE-2021-25874High
A SQL Injection vulnerability in AVideo/YouPHPTube 10.0 and prior allows an unauthenticated remote attacker to inject SQL code via the catName parameter. This enables retrieval of database information, including application password hashes.
Original NVD description (English source)
AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php.