CVE-2025-64114

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.

Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to videos.php or channels.php.

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, the Remote Play feature allowed adding videos by importing an external URL, leading to arbitrary command execution due to improper URL handling.

ClipBucket v5 versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment section within a channel. The obj_id parameter in the POST request to /actions/ajax.php is used within the user_exists function of the upload/includes/classes/user.class.php file as the $id parameter, and then used within the count function of the upload/includes/classes/db.class.php file. The $id parameter is concatenated into the query without validation or sanitization, and user-supplied input like 1' or 1=1-- - can trigger the injection. This issue does not have a fix at the time of publication.

ClipBucket 5.5.2 is shipped with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the admin panel, gaining full administrative control of the application.

ClipBucket v5 versions 5.5.2 - #156 and below allow an authenticated regular user to create a photo collection whose Collection Name contains HTML/JavaScript payloads, making ClipBucket’s Manage Photos feature vulnerable to Stored XSS. The payload is rendered unsafely in the Admin → Manage Photos interface, causing it to execute in the administrator’s browser, allowing an attacker to target administrators and perform actions with elevated privileges.

ClipBucket v5 through 5.5.3-#197 contains an SQL injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can use time-based blind payloads to extract user credentials and emails or modify and delete arbitrary records.

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.

ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with manage_template_access permission can traverse outside the layout directory to modify executable PHP files and achieve remote code execution as the web server user.