CVE-2026-102569
Received Received - Intake

Time-Based Blind SQL Injection in ClipBucket

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description
ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-102569
EUVD
EUVD-2026-88970

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
clipbucket clipbucket From 5 (inc) to 5.5.3-#197 (inc)
macwarrior clipbucket From 5.0.0 (inc) to 5.5.3-197 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ClipBucket v5 through 5.5.3-#197 has a time-based blind SQL injection flaw in the admin video edit function. The videoid parameter is directly concatenated into an UPDATE statement without proper escaping. An authenticated admin with video_moderation permission can inject malicious SQL commands to extract or modify database contents.

Detection Guidance

To detect this vulnerability, check ClipBucket v5 through 5.5.3-#197 for unauthenticated SQL injection attempts in the admin video edit function. Monitor logs for time-based blind SQLi patterns in videoid parameter updates. Use tools like sqlmap with time-based payloads targeting the videoid parameter in admin/video-edit.php.

Verify if the videoid parameter is directly concatenated into SQL queries without sanitization. Check for suspicious database queries in the upload/includes/classes/video.class.php file, particularly in the update_video function.

Impact Analysis

An attacker with admin access could steal sensitive data, modify database records, or potentially gain control over the system. This could lead to unauthorized access to user information, video content, or other confidential data stored in the database.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using ClipBucket may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update ClipBucket to the latest patched version or apply the fix from the GitHub commit that typecasts videoid to an integer in the update_video function. Ensure all user inputs in SQL queries are parameterized or properly escaped.

Restrict admin access to only trusted users with video_moderation permissions. Monitor database queries for unauthorized modifications. Consider disabling the video edit function temporarily if an update is not immediately feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart