ClipBucket vulnerabilities

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.

Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to videos.php or channels.php.

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, the Remote Play feature allowed adding videos by importing an external URL, leading to arbitrary command execution due to improper URL handling.

ClipBucket v5 versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. The obj_id parameter in the POST request to /actions/ajax.php is used within the user_exists function of the upload/includes/classes/user.class.php file as the $id parameter, and then used within the count function of the upload/includes/classes/db.class.php file. The $id parameter is concatenated into the query without validation or sanitization, and user-supplied input like 1' or 1=1-- - can trigger the injection. This issue does not have a fix at the time of publication.

ClipBucket 5.5.2 is shipped with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the admin panel, gaining full administrative control of the application.

ClipBucket v5 versions 5.5.2 - #156 and below allow an authenticated regular user to create a photo collection whose Collection Name contains HTML/JavaScript payloads, making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, allowing an attacker to target administrators and perform actions with elevated privileges.

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel origin.

ClipBucket v5 through 5.5.3-#197 contains an SQL injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can use time-based blind payloads to extract user credentials and emails or modify and delete arbitrary records.

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.

Blind SQL injection vulnerability in ClipBucket v5 before 5.5.3-#182 in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection to extract credentials and admin password hashes.

ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function fails to update the file extension after MIME validation, allowing a .php extension to persist and execute via PHP-FPM.

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the msg_id parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject the unsanitized message ID into a SQL query in cb_pm::delete_msg().

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability. An authenticated user can submit the check_photo parameter as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php, then inject unsanitized values into a SQL query in photo_exists() in photos.class.php.

ClipBucket v5 is an open source video sharing platform that prior to version 5.5.3 - #141 contained improper neutralization of SQL wildcard characters in the subtitle editing endpoint. An authenticated user could send a % character as the number parameter to overwrite all subtitle titles of any video they own in a single HTTP request.

ClipBucket v5 is an open source video sharing platform. In versions prior to 5.5.3 - #133, a normal authenticated user could edit another user's video subtitles due to a lack of authorization.

ClipBucket v5 is an open source video sharing platform that prior to version 5.5.3 - #132 had a vulnerability allowing authenticated users to add multiple subtitles from different files and change their titles. The POST /actions/subtitle_edit.php request used to change titles includes a number parameter that is vulnerable to SQL Injection.

Vulnerability in ClipBucket v5.5.2 allows remote attacker to execute arbitrary code via the authentication interface, login page, and HTTP response security headers.

ClipBucket v5 prior to version 5.5.2 - #164 contains an authorization bypass vulnerability in the AJAX flagging system that allows any unauthenticated user to flag any content (users, videos, photos, collections). This can lead to mass flagging attacks, content disruption, and moderation system abuse.

In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration base_url is not set. Because Host is client-controlled, an attacker can supply an arbitrary Host value, causing password-reset links sent by forget.php to point to the attacker's domain. If a victim follows the link and enters their activation code on the attacker-controlled domain, the attacker can capture the code and take over the account.

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database through its ClipBucket Custom Fields plugin. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. This issue is fixed in version 5.5.2 - #.

ClipBucket v5 versions 5.5.2-#147 and below contain a stored XSS vulnerability in the Collection tags feature. An authenticated normal user can create a tag containing HTML or JavaScript, which is later rendered unescaped on collection detail and tag-list pages.

ClipBucket v5 prior to version 5.5.2 #147 is vulnerable to arbitrary PHP code execution. The "type" parameter from a POST request in /upload/admin_area/actions/update_launch.php is embedded into PHP tags and executed without proper sanitization, allowing arbitrary PHP code execution.

ClipBucket v5 through build 5.5.2 #145 allows stored cross-site scripting (XSS) in multiple video and photo metadata fields. For videos, the Tags field and the Genre, Actors, Producer, Executive Producer, and Director fields in Movieinfos accept user-supplied values without adequate sanitization. For photos, the Photo Title and Photo Tags fields accept user-supplied values without adequate sanitization. A regular user who can edit a video or photo can inject script (for example by supplying a value such as a closing delimiter followed by a script element). The injected script executes when any user, including an unauthenticated visitor or an administrator, views the affected video or photo page. Version 5.5.2 build #146 and later contain a fix.

ClipBucket version 5.5.2 - #146 and earlier is vulnerable to path traversal in /admin_area/template_editor.php. Inadequate validation allows authenticated administrators to read and write arbitrary files outside the template directory. Fixed in version 5.5.2 - #147.

ClipBucket V5 version 5.5.2 - #140 and earlier contains a blind SQL injection vulnerability in the /admin_area/login_as_user.php file in the Admin Area. Exploitation requires access privileges to the Admin Area.