ClipBucket EUVD-2026-88970

Requires an authenticated ClipBucket v5 (through 5.5.3-#197) administrator account holding the video_moderation permission, using the admin video edit function; the videoid parameter is concatenated unescaped into an UPDATE statement's WHERE clause. Limiting factors: high-privilege authentication (admin + specific moderation permission), so this is not exploitable by anonymous or low-privilege users; no user interaction beyond the attacker's own request and no non-default configuration is needed once such an admin is authenticated.

This is a real but modest-priority issue. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N) scores 7.0 (High), but the dominant limiting factor is PR:H: exploitation requires an authenticated administrator who already holds the video_moderation permission, so an attacker must first obtain privileged admin credentials. Signals partly reinforce, partly temper the score: a public POC (a HackMD write-up documenting two blind SQLi in ClipBucket v5 5.5.3-#197) and a confirmed vendor patch commit both raise plausibility of exploitation, yet there is no EPSS score and no CISA KEV listing, indicating no evidence of active, widespread exploitation. The source-code diff confirms the root cause unambiguously (videoid concatenated into an UPDATE WHERE clause, fixed by an (int) cast), so the technical validity is high; the practical risk is bounded because a video_moderation admin can already legitimately alter video records, and the primary uplift here is arbitrary DB read/write beyond that role's intended scope. Net: high CVSS but constrained real-world risk due to the high-privilege precondition and low deployment footprint.

An authenticated ClipBucket administrator with video_moderation permission (or an attacker who has hijacked such an account) submits a crafted videoid value in the admin video-edit function, injecting time-based blind SQL into the backend UPDATE statement. Using boolean/time-delay techniques the attacker exfiltrates arbitrary database contents (e.g., user credentials, tokens) or tampers with records beyond their intended role. A public POC write-up exists (hackmd.io/@leediay), lowering the effort to reproduce.