Macwarrior
Monthly
Remote code execution in ClipBucket v5 (all releases before 5.5.3-#182) allows an authenticated low-privileged user to upload a PHP file that is stored and later executed by PHP-FPM, yielding full server compromise. The photo upload endpoint validates only the file's MIME type/magic bytes but never rewrites the extension, so a payload beginning with valid image magic bytes retains its .php extension on disk (CWE-434, CVSS 4.0 base 8.7 / independently assessed CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). Exploitation requires only a standard account - readily self-registered on default deployments with open registration - plus a web-executable upload directory served by PHP-FPM; there is no unauthenticated path and no public exploit code identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
Authenticated SQL injection in ClipBucket v5 (through release 5.5.3) lets any logged-in user read arbitrary database contents - including all user credential hashes and email addresses - by submitting the msg_id parameter as an array to the private-message deletion handler. The array form evades the clean_requests() sanitizer in ClipBucket.class.php, so unsanitized elements reach cb_pm::delete_msg(), which interpolates the message ID directly into a SQL query string and supports time-based blind extraction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a low-privilege authenticated remote attacker with high confidentiality impact only; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Authenticated users of ClipBucket v5 through 5.5.3 can extract arbitrary data - including credential hashes - from the underlying database by abusing a time-based blind SQL injection in the back-office bulk photo-deletion handler. The root cause is a parameter-type bypass: submitting the check_photo parameter as an array causes its elements to slip past the clean_requests() sanitization in ClipBucket.class.php and reach photo_exists() in photos.class.php, where non-numeric values are concatenated directly into a SQL query. Exploitation requires a valid ClipBucket account able to reach manage_photos.php (CVSS vector shows PR:L, unauthenticated access is not sufficient), the injection is blind and time-based so extraction is slow and iterative, and no public exploit code has been identified at time of analysis; EPSS scoring was not provided in the source data. This is a moderate-risk, authentication-gated data-disclosure flaw rather than a critical exposure.
OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote attackers run arbitrary shell commands as the web server user by supplying a crafted php_cli_filepath value in a POST request to the installer. The flaw stems from the installer passing this parameter unescaped into a shell command that invokes the PHP CLI. A vendor patch exists (commit 36e7c6c), it was reported by VulnCheck, and no public exploit has been identified at time of analysis.
Unauthenticated blind SQL injection in ClipBucket v5 prior to version 5.5.3 - #129 allows remote attackers to exfiltrate arbitrary database contents via the ids parameter of the actions/progress_video.php endpoint. The flaw carries a critical CVSS 9.8 score and no public exploit identified at time of analysis, but the trivial network-reachable attack surface on a public-facing video sharing platform makes opportunistic scanning likely. Vendor patch is available in 5.5.3 - #129 per the GHSA advisory.
Remote command injection in ClipBucket v5 prior to version 5.5.3 - #140 allows authenticated users to execute arbitrary OS commands by submitting a crafted URL through the Remote Play video import feature. The URL is concatenated unescaped into shell commands, so any metacharacter is interpreted by the shell, yielding code execution as the web server user. No public exploit identified at time of analysis, but the vendor-confirmed advisory and trivial exploitation pattern make this a high-priority issue for any internet-exposed deployment.
Authenticated SQL injection in ClipBucket v5 prior to release 5.5.3 - #132 allows any user with video-upload privileges to exfiltrate database contents via the POST /actions/subtitle_edit.php endpoint. The vulnerable 'number' parameter handling enables boolean-based blind SQLi, and no public exploit is identified at time of analysis though the GitHub Security Advisory (GHSA-q233-m544-6jqr) documents the issue in detail.
An authenticated time-based blind SQL injection vulnerability exists in the ClipBucket v5 open source video sharing platform, affecting versions prior to 5.5.3 #80. The vulnerability resides in the actions/ajax.php endpoint where the userid parameter lacks proper input sanitization, allowing authenticated attackers to execute arbitrary SQL queries. This can lead to full database disclosure and potential administrative account takeover with a CVSS score of 8.8.
SQL wildcard character injection in ClipBucket v5's subtitle editing endpoint allows authenticated users to overwrite all subtitle titles across every video they own in a single HTTP request. Affected versions are all releases prior to 5.5.3 - #141 of the open-source video sharing platform maintained by MacWarrior. No public exploit exists and the vulnerability is not listed in CISA KEV, but the trivial exploitation mechanism (a single % character) means any authenticated account could cause bulk subtitle data corruption against their own content.
ClipBucket v5's subtitle management feature lacks ownership verification, enabling any authenticated user to upload, rename, or delete subtitle tracks on videos belonging to other users. All releases prior to version 5.5.3 - #133 (CPE: cpe:2.3:a:macwarrior:clipbucket-v5) are affected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low attack complexity and network accessibility present credible risk in any multi-user ClipBucket deployment.
Remote code execution in ClipBucket v5 (all releases before 5.5.3-#182) allows an authenticated low-privileged user to upload a PHP file that is stored and later executed by PHP-FPM, yielding full server compromise. The photo upload endpoint validates only the file's MIME type/magic bytes but never rewrites the extension, so a payload beginning with valid image magic bytes retains its .php extension on disk (CWE-434, CVSS 4.0 base 8.7 / independently assessed CVSS 3.1 as AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). Exploitation requires only a standard account - readily self-registered on default deployments with open registration - plus a web-executable upload directory served by PHP-FPM; there is no unauthenticated path and no public exploit code identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV).
Authenticated SQL injection in ClipBucket v5 (through release 5.5.3) lets any logged-in user read arbitrary database contents - including all user credential hashes and email addresses - by submitting the msg_id parameter as an array to the private-message deletion handler. The array form evades the clean_requests() sanitizer in ClipBucket.class.php, so unsanitized elements reach cb_pm::delete_msg(), which interpolates the message ID directly into a SQL query string and supports time-based blind extraction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a low-privilege authenticated remote attacker with high confidentiality impact only; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Authenticated users of ClipBucket v5 through 5.5.3 can extract arbitrary data - including credential hashes - from the underlying database by abusing a time-based blind SQL injection in the back-office bulk photo-deletion handler. The root cause is a parameter-type bypass: submitting the check_photo parameter as an array causes its elements to slip past the clean_requests() sanitization in ClipBucket.class.php and reach photo_exists() in photos.class.php, where non-numeric values are concatenated directly into a SQL query. Exploitation requires a valid ClipBucket account able to reach manage_photos.php (CVSS vector shows PR:L, unauthenticated access is not sufficient), the injection is blind and time-based so extraction is slow and iterative, and no public exploit code has been identified at time of analysis; EPSS scoring was not provided in the source data. This is a moderate-risk, authentication-gated data-disclosure flaw rather than a critical exposure.
OS command injection in ClipBucket V5's web installer (versions 5.5.1 through 5.5.3-#153) lets unauthenticated remote attackers run arbitrary shell commands as the web server user by supplying a crafted php_cli_filepath value in a POST request to the installer. The flaw stems from the installer passing this parameter unescaped into a shell command that invokes the PHP CLI. A vendor patch exists (commit 36e7c6c), it was reported by VulnCheck, and no public exploit has been identified at time of analysis.
Unauthenticated blind SQL injection in ClipBucket v5 prior to version 5.5.3 - #129 allows remote attackers to exfiltrate arbitrary database contents via the ids parameter of the actions/progress_video.php endpoint. The flaw carries a critical CVSS 9.8 score and no public exploit identified at time of analysis, but the trivial network-reachable attack surface on a public-facing video sharing platform makes opportunistic scanning likely. Vendor patch is available in 5.5.3 - #129 per the GHSA advisory.
Remote command injection in ClipBucket v5 prior to version 5.5.3 - #140 allows authenticated users to execute arbitrary OS commands by submitting a crafted URL through the Remote Play video import feature. The URL is concatenated unescaped into shell commands, so any metacharacter is interpreted by the shell, yielding code execution as the web server user. No public exploit identified at time of analysis, but the vendor-confirmed advisory and trivial exploitation pattern make this a high-priority issue for any internet-exposed deployment.
Authenticated SQL injection in ClipBucket v5 prior to release 5.5.3 - #132 allows any user with video-upload privileges to exfiltrate database contents via the POST /actions/subtitle_edit.php endpoint. The vulnerable 'number' parameter handling enables boolean-based blind SQLi, and no public exploit is identified at time of analysis though the GitHub Security Advisory (GHSA-q233-m544-6jqr) documents the issue in detail.
An authenticated time-based blind SQL injection vulnerability exists in the ClipBucket v5 open source video sharing platform, affecting versions prior to 5.5.3 #80. The vulnerability resides in the actions/ajax.php endpoint where the userid parameter lacks proper input sanitization, allowing authenticated attackers to execute arbitrary SQL queries. This can lead to full database disclosure and potential administrative account takeover with a CVSS score of 8.8.
SQL wildcard character injection in ClipBucket v5's subtitle editing endpoint allows authenticated users to overwrite all subtitle titles across every video they own in a single HTTP request. Affected versions are all releases prior to 5.5.3 - #141 of the open-source video sharing platform maintained by MacWarrior. No public exploit exists and the vulnerability is not listed in CISA KEV, but the trivial exploitation mechanism (a single % character) means any authenticated account could cause bulk subtitle data corruption against their own content.
ClipBucket v5's subtitle management feature lacks ownership verification, enabling any authenticated user to upload, rename, or delete subtitle tracks on videos belonging to other users. All releases prior to version 5.5.3 - #133 (CPE: cpe:2.3:a:macwarrior:clipbucket-v5) are affected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low attack complexity and network accessibility present credible risk in any multi-user ClipBucket deployment.