Description
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
MacWarrior clipbucket-v5
Default version status: unaffected
0 to < 5.5.3-#182affected
pkg:github/MacWarrior/clipbucket-v5References
- https://github.com/MacWarrior/clipbucket-v5/pull/874 ↗
- https://github.com/MacWarrior/clipbucket-v5/commit/7fd0af6f8b5826c2d6ef0976dbb1867f5c36b707 ↗
- https://github.com/MacWarrior/clipbucket-v5/blob/57b0235f2eae390f4946c042bf81c182a9f82782/upload/includes/classes/photos.class.php#L408-L413 ↗
- https://hackmd.io/@leediay/sqli-photo-seach-clipbucketv5 ↗
- https://github.com/MacWarrior/clipbucket-v5 ↗
- https://www.vulncheck.com/advisories/clipbucket-v5-before-5.5.3-182-sql-injection-via-search-result-php ↗