Talos Vulnerability Report


YouPHPTube /objects/videoAddNew.json.php SQL injection vulnerability

October 17, 2019
CVE Number



An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and,in certain configuration, access the underlying operating system.

Tested Versions

YouPHPTube 6.2
YouPHPTube 7.6
YouPHPTube 7.7 commit 64d35de96e43c5e5b3d582162c12b86eec7e986b (Oct 1st 2019)

Product URLs


CVSSv3 Score

7.4 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L


CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)


A SQL injection vulnerability exist in YouPHPTube 7.6. A successful attack could allow an attacker to access information such as usernames and password hashes that are stored in the database.

The /objects/videoAddNew.json.php URL and parameter categories_id have been confirmed to suffer from a SQL injection and could be exploited by authenticated attackers:

POST /objects/videoAddNew.json.php HTTP/1.1
Host: [IP]
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://[IP]/mvideos
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 120
DNT: 1
Connection: close

id=12&title=a&videoLink=z&clean_title=a&description=z&categories_id=1[SQL INJECTION]&public=true&next_videos_id=23&users_id=11


2019-09-20 - Vendor Disclosure
2019-10-16 - Vendor Patched
2019-10-17 - Public Release


Discovered by Yuri Kramarz of Security Advisory EMEAR.