CVE-2019-5127 PoC — YouPHPTube Encoder 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-5127.yaml

Associated Vulnerability

Title:YouPHPTube Encoder 操作系统命令注入漏洞 (CVE-2019-5127)
Description:YouPHPTube是一套基于PHP的视频网站系统。YouPHPTube Encoder是其中的一个编码器。 YouPHPTube Encoder 2.3版本中的/objects/getImage.php文件的‘base64Url’参数存在操作系统命令注入漏洞。该漏洞源于外部输入数据构造操作系统可执行命令过程中，网络系统或产品未正确过滤其中的特殊字符、命令等。攻击者可利用该漏洞执行非法操作系统命令。

Description

YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php.

File Snapshot


 id: CVE-2019-5127

info:
  name: YouPHPTube Encoder 2.3 - Remote Command Injection
  author: pikpikc

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!