CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 7.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: an issue was discovered in youphptube through 7.7. user input passed through the live_stream_code post parameter to /plugin/livechat/getchat.json.php is not properly sanitized (in getfromchat in plugin/livechat/objects/livechatobj.php) before being used to construct a sql query. this can be exploited by malicious users to, e.g., read sensitive data from the database through in-band sql injection attacks. successful exploitation of this vulnerability requires the live chat plugin to be enabled.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-11-02
Last Modified Date: 2019-11-06