Executive brief
ClipBucket v5, an open-source video sharing platform, contains a critical security flaw in its video progress tracking component. An unauthorized attacker can exploit this vulnerability to bypass security controls and access the underlying database. This could lead to the theft of sensitive user information, including account credentials and configuration data, potentially compromising the entire platform.
Technical details
A blind SQL injection vulnerability exists in ClipBucket v5 prior to version 5.5.3 - #129. The issue resides in the 'actions/progress_video.php' endpoint, specifically within the handling of the 'ids' POST parameter. While single integer IDs are properly cast, the application fails to validate or sanitize array-based inputs passed to the 'Video::getAll' method. The 'mysql_clean' function fails to escape characters like parentheses and comparison operators, allowing an attacker to break out of an 'IN' clause and append arbitrary SQL logic. An unauthenticated remote attacker can use this to perform boolean-based or error-based blind SQL injection to exfiltrate sensitive data from the database, such as user hashes and system configurations. The vulnerability is patched in version 5.5.3 - #129.
Affected products
- MacWarrior ClipBucket v5 <= 5.5.3 - #128
Timeline
- 2026-05-22: advisory: Vendor advisory published on GitHub
- 2026-06-11: disclosed: CVE published to NVD