Executive brief
ClipBucket is a popular video sharing and streaming platform. A blind SQL injection vulnerability in the photo management feature allows authenticated users to extract sensitive data, including credential hashes, from the database by bypassing input validation filters. An attacker with access to a user account can retrieve any data stored in the database over time using timing-based queries.
Technical details
The vulnerability is a blind (time-based) SQL injection affecting the photo deletion handler in ClipBucket v5 before version 5.5.3-#182. The root cause is inadequate sanitization in the clean_requests() function in ClipBucket.class.php, which fails to properly validate array parameters. When the check_photo parameter is submitted as an array, unsanitized elements bypass validation and are passed through the bulk deletion handler in manage_photos.php to the photo_exists() function in photos.class.php, where non-numeric values are directly interpolated into SQL queries. Authentication is required to exploit this vulnerability, and it relies on time-based blind injection techniques to extract data. The patch is available in version 5.5.3-#182 and later releases.
Affected products
- ClipBucket ClipBucket v5 before 5.5.3-#182
Timeline
- 2026-09-18: disclosed
- 2026-08-28: patched: Fixed in version 5.5.3-#182