Executive brief
EI-Tube Script, a tool used for building video-sharing websites via the YouTube API, contains a security flaw in its search functionality. An unauthorized attacker can use this flaw to access the website's underlying database without needing a password. This could lead to the theft of sensitive information, including user credentials and system configuration details.
Technical details
An SQL injection vulnerability exists in PHP EI-Tube Script version 3.0 and earlier due to improper neutralization of special elements in the 'q' parameter of the search endpoint. An unauthenticated remote attacker can exploit this by sending specially crafted GET requests containing SQL payloads (e.g., using UNION SELECT statements). Successful exploitation allows the attacker to execute arbitrary SQL commands, potentially leading to the extraction of sensitive database records such as administrative usernames, password hashes, and database version information. The vulnerability is confirmed by public exploit code demonstrating the use of the search parameter to leak database metadata.
Affected products
- EI-Tube EI-Tube Script 3.0 and earlier
Timeline
- 2019-02-21: disclosed: Initial exploit published on Exploit-DB
- 2026-06-04: advisory: NVD and VulnCheck published formal advisory details