Description
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MacWarrior clipbucket-v5
Default version status: unaffected
0 to ≤ 5.5.3-#197affected
References
- https://hackmd.io/@leediay/sqli-via-delete-ads-clipbucketv5 ↗
- https://github.com/MacWarrior/clipbucket-v5/pull/925 ↗
- https://github.com/MacWarrior/clipbucket-v5/blob/f15cef1a2431786c31ffd79e81f55d6eeca4ebc0/upload/includes/classes/ads.class.php#L102-L110 ↗
- https://github.com/MacWarrior/clipbucket-v5 ↗
- https://www.vulncheck.com/advisories/clipbucket-v5-through-5.5.3-197-sql-injection-via-ads-manager-php-delete-parameter ↗