CVE-2019-16124 - In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code

Back Back to CVE browser

CRITICAL

In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code

Published Sep 9, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 27.58%

Description

In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to edit the configuration file, and insert malicious PHP code.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6963
Advisory
https://github.com/YouPHPTube/YouPHPTube/commit/b32b410c9191c3c5db888514c29d7921f124d883
x_refsource_MISCPatchThird Party Advisory
https://www.exploit-db.com/exploits/47326
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://zerodays.lol/
x_refsource_MISCThird Party AdvisoryURL Repurposed

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6963		Advisory
https://github.com/YouPHPTube/YouPHPTube/commit/b32b410c9191c3c5db888514c29d7921f124d883		x_refsource_MISCPatchThird Party Advisory
https://www.exploit-db.com/exploits/47326		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://zerodays.lol/		x_refsource_MISCThird Party AdvisoryURL Repurposed