CyberRota Analysis
AI-GeneratedClipBucket versions 5 through 5.5.3-#197 are vulnerable to an SQL injection flaw that enables authenticated users with ad_manager_access permission to manipulate SQL queries through the delete parameter in admin_area/ads_manager.php. This vulnerability allows attackers to execute time-based blind payloads, potentially leading to the extraction of sensitive user credentials and emails or unauthorized modification and deletion of records. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.