CVE-2019-5129 Scanner

YouPHPTube Encoder is a plugin for the YouPHPTube video sharing platform, responsible for converting and processing video files into various formats. It is used by media administrators and content delivery services to streamline video encoding workflows, ensuring compatibility across devices. The encoder handles tasks like thumbnail generation and format transformation, making it a critical component for video streaming infrastructure.

CVE-2019-5129 is a critical command injection vulnerability in YouPHPTube Encoder version 2.3. It arises because user-supplied input is not properly sanitized before being passed to system commands. Attackers can inject arbitrary commands by manipulating the 'base64Url' parameter, which is used in image processing functions. This flaw is unauthenticated, meaning no login is required to exploit it.

The vulnerability specifically exists in the '/objects/getImageMP4.php' endpoint, where the 'base64Url' parameter is concatenated directly into a shell command. An attacker can craft a malicious request containing command separators like semicolons or pipes to execute arbitrary code on the server. This endpoint is accessible over the network, making remote exploitation possible.

If exploited, an attacker can gain full control over the affected server, leading to data theft, malware installation, or service disruption. Since the encoder often runs with elevated privileges, the impact can extend to the entire hosting environment. This could compromise sensitive video content, user data, and other connected systems, posing a severe risk to business operations.