Executive brief
ClipBucket is a video sharing platform application. A flaw in the private message deletion feature allows authenticated users to inject malicious SQL commands by bypassing input validation, enabling them to extract sensitive data including all user passwords and email addresses from the database.
Technical details
The vulnerability is a blind SQL injection in the private message deletion handler (private_message.php) affecting ClipBucket v5 before version 5.5.3-#182. The root cause is that the clean_requests() sanitization function in ClipBucket.class.php can be bypassed by passing the msg_id parameter as an array, which then flows unsanitized into cb_pm::delete_msg(). The vulnerable code directly interpolates the unescaped message ID into a SQL query string without proper parameterization. The attack requires authentication and allows time-based blind SQL injection to extract arbitrary database contents. The vulnerability was patched in version 5.5.3-#182 released on 28 August 2026.
Affected products
- ClipBucket ClipBucket v5 before 5.5.3-#182
Timeline
- 2026-09-18: disclosed
- 2026-08-28: patched: Version 5.5.3-#182 released