EUVD-2026-91138
GHSA-29w7-pp39-xf4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with ad_manager_access account
-
DeliverySubmit crafted delete parameter to ads_manager.php
-
ExploitInject time-based blind payload into DeleteAd query
-
ExecutionExfiltrate credentials/emails or alter records
-
ImpactAccount takeover / data loss
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated ClipBucket v5 account possessing the ad_manager_access permission; the attacker must reach admin_area/ads_manager.php and supply a malicious value in the delete parameter, which flows unsanitized into AdsManager::DeleteAd's DELETE FROM ads_data WHERE ad_id query (confirmed by the patch diff). Limiting factors: this is not unauthenticated - it is gated behind a privileged admin-area role, so exposure is confined to deployments that grant ad-manager rights to additional or semi-trusted users; affects versions through 5.5.3-#197, and the public patch (int-casting the id) neutralizes the injection once applied. |
| Impact | This is a genuine but access-gated vulnerability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the description agree that exploitation is network-reachable and low-complexity but requires an authenticated admin-area account holding the ad_manager_access permission - PR:H means this is NOT an anonymous internet-facing bug. A publicly available proof-of-concept exists (hackmd write-up referenced by the CVE), which raises practical risk, but there is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. The high VC/VI/VA (H/H/H) reflect real impact: credential/email extraction and arbitrary record modification/deletion. Net: a high-impact but privilege-dependent flaw that is a priority for ClipBucket operators (especially where ad-manager rights are delegated to semi-trusted staff) rather than a mass-exploitation emergency. Missing data: EPSS probability and KEV status are absent from the input; absence is not evidence of low risk but means no exploitation-frequency signal is available. |
| Exploit ScenarioDerived | An attacker who already holds a ClipBucket v5 account with ad_manager_access (for example a delegated marketing/ads staff member or a compromised sub-admin) opens admin_area/ads_manager.php and submits a crafted value in the delete parameter. Because DeleteAd concatenates the value directly into a DELETE query, they inject a time-based blind SQL payload to exfiltrate user credentials and emails or to tamper with database records. A public PoC write-up detailing this technique already exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - pull request https://github.com/MacWarrior/clipbucket-v5/pull/925 hardens the ad manager by casting ad identifiers to (int) in AdsManager::DeleteAd ('DELETE FROM ads_data WHERE ad_id=\'' . (int)$id . '\'') and by applying (int) casts or mysql_clean() to the other interpolated sinks in ads.class.php, so applying that commit or tracking the next tagged ClipBucket v5 release that includes it is the primary fix; because no tagged release has been independently confirmed, verify the merged diff is present before considering the issue closed. Until then, the most effective compensating control is to enforce least privilege on the ad_manager_access permission and remove it from any account that is not fully trusted, since the entire attack path is gated behind that role - the trade-off is reduced delegation of ad management to content or marketing staff, who will need an administrator to perform those actions for them. Because the injectable value enters through the delete parameter of admin_area/ads_manager.php, blocking or rate-limiting POST/GET requests to that endpoint from untrusted sources, or fronting the admin area with an access-controlled reverse proxy, source-IP allowlist, or WAF rule that rejects non-integer delete parameter values, will neutralize the injection with the side effect of potentially disrupting legitimate ad-management workflows and generating false positives. Finally, review database and web server logs for anomalous delay-based queries against the ads_data table and for unexpected deletions in ads_data, and rotate application and database credentials plus any user password hashes that may have been exfiltrated through blind extraction.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ClipBucket v5 is a self-hosted PHP video-sharing platform; its ad subsystem lives in upload/includes/classes/ads.class.php, where the class methods AdsManager::DeleteAd, ChangeAdStatus, EditAd, RemovePlacement and others build SQL strings by hand and pass them to Clipbucket_db::execute/update/count. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): DeleteAd interpolates the caller-supplied ad id directly into 'DELETE FROM ' . tbl('ads_data') . ' WHERE ad_id=\'' . $id . '\'' without quoting or type casting, so a value supplied through the delete parameter of admin_area/ads_manager.php is evaluated as SQL. Because the injected value sits inside a DELETE statement, an attacker cannot simply append rows to the result set; instead they use time-based blind techniques (e.g. conditional SLEEP()/database-specific delays) to exfiltrate data such as user password hashes and emails one bit at a time, or craft subqueries and stacked conditions to alter or remove records. The upstream pull request 925 (MacWarrior/clipbucket-v5) confirms the root cause by changing every affected sink to strict typing or escaping - most importantly casting $id to (int) in DeleteAd, and replacing bare interpolation in EditAd, ChangeAdStatus, incrementImpression, getAd, get_placement and get_ad_details with (int) casts or mysql_clean(). The CPE cpe:2.3:a:macwarrior:clipbucket-v5:*:*:*:*:*:*:*:* covers the affected distribution, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) matches the assessment that exploitation requires high privilege and no user interaction.
Know when Clipbucket V5 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable admin endpoint with low complexity, but requires the privileged ad_manager_access role so PR:H; SQLi yields full read (C:H) plus record modification/deletion (I:H/A:H), scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.
Technical POC Analysis
CWE-89.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity SQL injection in ClipBucket v5 (through 5.5.3-#197) could let a user with ad-manager permissions read or alter the application database, including user credentials and email addresses. Exploitation requires a privileged ad-manager role, so the risk is greatest for organizations that assign ad-management rights broadly or to semi-trusted staff. Leadership should prioritize confirming patch deployment and tightening access to the ad manager.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Clipbucket V5
View allAuthenticated administrators of ClipBucket v5 who hold the manage_template_access permission can abuse a path traversal
Unauthenticated blind SQL injection in ClipBucket v5 (before 5.5.3-#182) allows remote attackers to extract sensitive da
Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the
Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator ho
Remote command injection in ClipBucket v5 prior to version 5.5.3 - #140 allows authenticated users to execute arbitrary
Unauthenticated blind SQL injection in ClipBucket v5 prior to version 5.5.3 - #129 allows remote attackers to exfiltrate
Reflected cross-site scripting (CWE-79) in ClipBucket v5 before 5.5.3-#182 allows unauthenticated remote attackers to in
OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote at
Authenticated SQL injection in ClipBucket v5 prior to release 5.5.3 - #132 allows any user with video-upload privileges
An authenticated time-based blind SQL injection vulnerability exists in the ClipBucket v5 open source video sharing plat
Remote code execution in ClipBucket v5 (all releases before 5.5.3-#182) allows an authenticated low-privileged user to u
Authenticated users of ClipBucket v5 through 5.5.3 can extract arbitrary data - including credential hashes - from the u
Exploit-DB