Executive brief
ClipBucket, an open-source video sharing platform, contains a security flaw that allows registered users to manipulate the site's database. By exploiting the video subtitle editing feature, an attacker can bypass security controls to view sensitive information or modify data they should not have access to. This could lead to the theft of user credentials or unauthorized changes to video content.
Technical details
A boolean-based blind SQL injection vulnerability exists in ClipBucket v5 prior to version 5.5.3 - #132. The flaw is located in the `update_subtitle` function within `upload/includes/classes/video.class.php`, where the `number` parameter from a POST request to `/actions/subtitle_edit.php` is concatenated directly into a SQL UPDATE query without sanitization. An authenticated attacker with video upload permissions can inject arbitrary SQL commands via this parameter. By observing whether the subtitle title successfully updates (the 'oracle'), an attacker can perform blind data exfiltration. This can also be combined with IDOR to affect videos belonging to other users. The issue is fixed in version 5.5.3 - #132 by implementing proper parameter handling.
Affected products
- MacWarrior ClipBucket < 5.5.3 - #132
Timeline
- 2026-05-18: advisory: Original GitHub security advisory published
- 2026-06-11: disclosed: CVE published to NVD
- 2026-06-11: patched: Fix released in version 5.5.3 - #132