Technical impact
PHP EI‑Tube Script 3 is vulnerable to an unauthenticated SQL injection through its search endpoint. An attacker can craft special GET requests that inject malicious SQL into the search query, causing the application to execute the attacker’s code against the database. This allows the extraction of sensitive data such as usernames, passwords, and database version information, compromising the confidentiality of user credentials and potentially enabling further attacks if the database credentials are exposed.
Affected Systems
The vulnerability affects the EI‑Tube script 3 application distributed by eitube. No specific product version numbers are listed in the CNA data, so any installation of EI‑Tube Script 3 is potentially susceptible.
Risk and Exploitability
The CVSS score of 8.8 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector relies on an unauthenticated GET request to a public endpoint, exploitation is straightforward for an attacker who can reach the search URL. The lack of function or administrative authentication means any visitor to the site could perform the injection.
