CVE-2019-16124

Опубликовано: 09 сент. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.

Ссылки

https://github.com/YouPHPTube/YouPHPTube/commit/b32b410c9191c3c5db888514c29d7921f124d883
Patch
Third Party Advisory
https://www.exploit-db.com/exploits/47326
Exploit
Third Party Advisory
VDB Entry
https://zerodays.lol/
Third Party Advisory
URL Repurposed
https://github.com/YouPHPTube/YouPHPTube/commit/b32b410c9191c3c5db888514c29d7921f124d883
Patch
Third Party Advisory
https://www.exploit-db.com/exploits/47326
Exploit
Third Party Advisory
VDB Entry
https://zerodays.lol/
Third Party Advisory
URL Repurposed

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:youphptube:youphptube:*:*:*:*:*:*:*:*

Версия до 7.4 (включая)

EPSS

Процентиль: 84%

0.02121

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-862

Связанные уязвимости

GHSA-h63m-qhvj-pcgq

github

больше 3 лет назад