A command injection have been found in YouPHPTube Encoder.

Summary

A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack.

Timeline

1. Oct 25, 2019, 5:12 PM UTCCVE published
2. Aug 4, 2024, 7:47 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a YouPHPTube

  YouPHPTube Encoder 2.3

References 2