ClipBucket V5 CVE-2025-62423

Exploitation requires authenticated access to the ClipBucket V5 Admin Area - the description explicitly states 'requires access privileges to the Admin Area', and the CVSS PR:H confirms high-privilege authentication. The specific vulnerable endpoint is /admin_area/login_as_user.php, where the 'uid' GET parameter is passed unsanitized into get_user_details(), which concatenates it directly into a SQL WHERE clause. Affected versions are 5.5.2 revision #140 and earlier (fixed in revision #142). The primary limiting factor is the admin-privilege requirement, which excludes unauthenticated or low-privilege attackers; no user interaction is needed and the attack is network-reachable once admin access is held.

This is a genuine but access-gated vulnerability. The CVSS vector (AV:N/AC:L/PR:H/UI:N) and the description agree cleanly - network-reachable, low complexity, no user interaction, but requiring high privileges (admin-area access), yielding full C:H/I:H/A:H impact for a 7.2 (High). The signals are consistent and not conflicting. EPSS is low at 0.52% (42nd percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. Publicly available exploit code exists (vendor GHSA advisory), which raises practical risk, but POC availability is not the same as in-the-wild exploitation. The key limiting factor is PR:H: an attacker must already hold Admin Area credentials, which sharply narrows the realistic threat to insiders, compromised admin accounts, or post-authentication privilege abuse rather than opportunistic internet-wide attacks. Net: a real but lower-priority issue - patch promptly, but it does not represent an unauthenticated mass-exploitation threat. The CVSS-7.2 high score is driven by impact, not by ease of unauthenticated access.

An attacker who already has Admin Area access (or has compromised an admin session) sends a crafted request to /admin_area/login_as_user.php with a malicious 'uid' parameter, which is passed unsanitized into a SQL WHERE clause in get_user_details(). Using blind SQL injection techniques, they infer and extract database contents such as user credentials and session data. Publicly available exploit code exists in the vendor's GHSA-3wpr-jprj-52fc advisory, lowering the skill barrier.