CVE-2019-5116

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configuration, access the underlying operating system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	YouPHPTube	YouPHPTube 6.2 ,YouPHPTube 7.6 ,YouPHPTube 7.7 commit 64d35de96e43c5e5b3d582162c12b86eec7e986b (Oct 1st 2019)

References

https://talosintelligence.com/vulnerability_reports/TALOS-2019-0907Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0907Exploit, Third Party Advisory

Timeline

Published: Oct 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-51178.8Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQ CVE-2019-51198.8An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL i CVE-2019-51208.8An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL CVE-2019-51218.8SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. A CVE-2019-51228.8SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. A CVE-2019-51238.8Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects CVE-2019-51248.6An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.50005. A specially crafted pixel shad CVE-2019-51257.8An exploitable heap overflow vulnerability exists in the JPEG2000 parsing functionality of LEADTOOLS 20. A specially crafted J2K image file CVE-2019-51268.8An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader, version 9.7.0.29435. A specially crafted PD CVE-2019-51279.8A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable CVE-2019-51289.8A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable CVE-2019-51299.8A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable