一、 漏洞 CVE-2021-47749 基础信息

                                        # YouPHPTube 7.8 目录遍历漏洞

N/A
                                        

二、漏洞 CVE-2021-47749 的公开POC

三、漏洞 CVE-2021-47749 的情报信息

• 标题： YouPHPTube<= 7.8 - Multiple Vulnerabilities - PHP webapps Exploit -- 🔗来源链接

  标签：exploit

  神龙速读：

                                          ## 关键信息
  
  - **漏洞标题**: YouPHPTube <= 7.8 - Multiple Vulnerabilities
  - **EDB-ID**: 51101
  - **CVE**: N/A
  - **作者**: Rafael Pedrero
  - **类型**: WEBAPPS
  - **平台**: PHP
  - **日期**: 2023-03-28
  - **易受攻击的应用**: YouPHPTube
  - **漏洞类型**: LFI + Path Traversal, Reflected Cross-Site Scripting (XSS)
  - **CVSS v3**: 7.5 (LFI), 6.5 (XSS)
  - **CWE**: CWE-829, CWE-22 (LFI), CWE-79 (XSS)
  - **测试版本**: 7.8
  - **测试环境**: Windows 7, 10 using XAMPP
  
  ## 漏洞描述
  
  ### LFI + Path Traversal
  - **问题**: YouPHPTube v7.8允许未经授权的目录访问。
  - **参数**: "lang" 可以被修改并加载服务器上的PHP文件。
  - **利用示例**: `http://127.0.0.1/youphptube/?lang=../phpinfo`
  
  ### Reflected Cross-Site Scripting (XSS)
  - **问题**: YouPHPTube 7.8及以下版本未充分编码用户控制的输入，导致通过 `redirectUri` 参数的反射型XSS漏洞。
  - **利用示例**: `http://localhost/<YouPHPTube_path_directory>/signup?redirectUri="()%26%25<ScRipt>alert(1)</ScRipt>`
                                          

  
• https://web.archive.org/web/20170506141644/https://www.youphptube.com/product

• 标题： YouPHPTube <= 7.8 - Directory Traversal | Advisories | VulnCheck -- 🔗来源链接

  标签：third-party-advisory

  神龙速读：

                                          从该网页截图中，可以获取到以下关于漏洞的关键信息：
  
  - **Advisories**: YouPHPtube <= 7.8 - Directory Traversal
  
  - **SEVERITY**: \[
    \text{HIGH}
  \]
  
  - **DATE**: \
    January 13, 2026
  
  - **AFFECTING**: \
    - YouPHPtube <= 7.8
  
  - **CVE**: \[
    \text{CVE-2021-47749} \, \mathrm{CVE}
  \]
  
  - **CWE**: \[
    \text{CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')}
  \]
  
  - **CVSS**: \
    9.1/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
  
  - **URLS**: \
    - <https://www.exploitdb.com/exploits/51101> \
    - [Archived YouPHPtube Homepage](https://web.archive.org/web/20210125140541/https://www.youphp.com/)
  
  - **CREDIT**: \
    Rafael Pedrero
  
  - **DESCRIPTION**: \
    YouPHPtube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. Attackers can exploit the path traversal flaw in locale/function.php to include and view PHP files outside the intended directory by using directory traversal sequences.
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2021-47749

四、漏洞 CVE-2021-47749 的评论