Description
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MacWarrior clipbucket-v5
Default version status: unaffected
0 to ≤ 5.5.3-#197affected
pkg:github/MacWarrior/clipbucket-v5References
- https://github.com/MacWarrior/clipbucket-v5/commit/ecbdf2d534ac7ef34a5a34e6e4c198da57d0c12c ↗
- https://github.com/MacWarrior/clipbucket-v5/blob/f15cef1a2431786c31ffd79e81f55d6eeca4ebc0/upload/includes/classes/lang.class.php#L365 ↗
- https://hackmd.io/@leediay/two-blind-sqli-clickbucketv5-version_5_5_3_197 ↗
- https://github.com/MacWarrior/clipbucket-v5 ↗
- https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-197-sql-injection-via-language-id-parameter ↗