CyberRota Analysis
AI-GeneratedClipBucket versions prior to 5.5.3-#182 are vulnerable to a blind SQL injection in the photo search endpoint, allowing unauthenticated attackers to manipulate SQL queries through unsanitized input. This vulnerability can lead to the extraction of sensitive information, including user credentials and administrator password hashes, posing a significant risk of account takeover. Organizations using affected versions should prioritize patching to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.