Threat Intelligence Database

ClipBucket v5 through version 5.5.3-#197 contains a high-severity SQL injection vulnerability. Authenticated users with ad_manager_access permission can exploit this flaw by injecting SQL commands via the delete parameter in the ads_manager.php admin interface. This allows attackers to perform time-based blind SQL injection attacks to extract sensitive data such as user credentials and emails or to modify and delete arbitrary database records.

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function. This flaw allows an authenticated administrator with basic_settings permission to inject arbitrary SQL commands via the language_id parameter, which is not properly escaped in an UPDATE statement's WHERE clause. The vulnerability can be exploited to extract or modify database contents.

ClipBucket v5 through 5.5.3-#197 has a time-based blind SQL injection vulnerability in its admin video edit function. This flaw allows an authenticated administrator with video_moderation permission to inject arbitrary SQL commands via the videoid parameter, which is improperly escaped in an UPDATE statement.

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.

ClipBucket v5 before 5.5.3-#182 has a blind SQL injection vulnerability in its photo search endpoint. The vulnerability arises because a query parameter is unsanitized and used directly in SQL WHERE and ORDER BY clauses. This allows unauthenticated attackers to perform time-based blind SQL injection attacks to extract sensitive information such as user credentials, email addresses, and administrator password hashes, potentially leading to account takeover.

ClipBucket v5 before 5.5.3-#182 has a reflected cross-site scripting (XSS) vulnerability in the sort_link() helper function. This flaw occurs because the cat, sort, and time query parameters are not properly sanitized, allowing attackers to inject malicious JavaScript payloads. Successful exploitation could lead to arbitrary script execution in users' browsers within the context of the affected application.

ClipBucket v5 before 5.5.3-#182 has a file upload vulnerability that allows authenticated users to upload PHP files disguised as images. This leads to remote code execution because the file extension is not properly updated after MIME validation, allowing PHP code execution via PHP-FPM.

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the deletion handler in private_message.php into cb_pm::delete_msg(), which interpolates the unescaped message ID directly into a SQL query string, enabling time-based blind SQL injection to retrieve all user credential hashes and email addresses.

ClipBucket v5 before 5.5.3-#182 has a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database data. The flaw arises from improper sanitization of the check_photo parameter when submitted as an array, bypassing the clean_requests() function. Unsanitized inputs reach SQL queries in photos.class.php, enabling time-based blind SQL injection attacks to retrieve sensitive information such as credential hashes.

ClipBucket V5 version 5.5.1 contains an OS command injection vulnerability in its web installer. The vulnerability arises because the php_cli_filepath parameter is not properly validated or escaped before being passed to shell execution. This allows unauthenticated attackers to execute arbitrary commands as the web server user by submitting a crafted POST request to the installer. The vulnerability has a critical severity with a CVSS score of 9.2.