CVE-2026-32321
Authenticated Blind SQL Injection in ClipBucket `actions/ajax.php` Risks Data Exposure
Publication date: 2026-03-18
Last updated on: 2026-03-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oxygenz | clipbucket | From 5.3 (inc) to 5.5.3-80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32321 is an authenticated time-based blind SQL injection vulnerability in the ClipBucket video sharing platform versions prior to 5.5.3. It exists in the `actions/ajax.php` endpoint due to insufficient input sanitization of the `userid` parameter. An attacker who is authenticated can exploit this by injecting arbitrary SQL queries through the `userid` parameter, which is directly used in SQL statements without proper cleaning or validation.
This vulnerability allows attackers to execute unauthorized SQL commands, potentially leading to full disclosure of the database contents and administrative account takeover.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive data stored in the database, such as user credentials and administrative account information.
- Full database disclosure allowing attackers to extract sensitive information.
- Potential administrative account takeover, enabling attackers to gain control over the application.
- Further compromise of the application and possibly the underlying server.
The vulnerability has a high severity rating with a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by performing authenticated SQL injection testing on the ClipBucket endpoint `/actions/ajax.php` targeting the `userid` POST parameter.'}, {'type': 'paragraph', 'content': 'Automated tools like sqlmap can be used to detect the time-based blind SQL injection by sending crafted POST requests with malicious `userid` values.'}, {'type': 'paragraph', 'content': 'An example sqlmap command to test for this vulnerability is:'}, {'type': 'list_item', 'content': 'sqlmap -u "http://[TARGET_URL]/actions/ajax.php" --data "mode=get_subscribers_count&userid=1" --cookie "PHPSESSID=[SESSION_COOKIE]" -p userid --dbms mysql --technique T --batch'}] [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade ClipBucket to version 5.5.3 or later, where this vulnerability has been fixed.
The fix involves proper input sanitization and type casting of the `userid` parameter before it is used in SQL queries, preventing SQL injection.
If upgrading immediately is not possible, ensure that all user inputs, especially the `userid` parameter in `/actions/ajax.php`, are sanitized by casting to integers or using sanitization functions like `mysql_clean()` before use in SQL queries.
Additionally, restrict access to authenticated users only and monitor for suspicious database query patterns or unusual activity related to the `userid` parameter.