CVE-2026-96272
Received Received - Intake

Blind SQL Injection in ClipBucket v5 Photo Search

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96272
EUVD
EUVD-2026-84991

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
macwarrior clipbucket to 5.5.3-#182 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96272 is a blind SQL injection vulnerability in ClipBucket v5 versions before 5.5.3-#182. The flaw exists in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit this using time-based blind SQL injection techniques to extract sensitive data like user credentials, email addresses, and administrator password hashes.

Detection Guidance

To detect this vulnerability, send a crafted HTTP GET request to the photo search endpoint with a time-based blind SQL injection payload. For example, use: curl -v 'http://target.com/search_result.php?query='')+OR+SLEEP(5)--+-'. If the server responds after a delay, the vulnerability likely exists.

Impact Analysis

This vulnerability allows unauthenticated attackers to extract sensitive data such as user credentials, email addresses, and administrator password hashes. This can lead to full account takeover and unauthorized access to the system.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA due to the potential exposure of sensitive personal data. Under GDPR, unauthorized access to user credentials, email addresses, and password hashes violates principles of data protection and user privacy, potentially leading to regulatory fines. For HIPAA, if ClipBucket is used in healthcare contexts, the exposure of such data would constitute a breach of protected health information, requiring notifications and corrective actions.

Mitigation Strategies

Immediately update ClipBucket to version 5.5.3-#182 or later, which includes the fix. If updating is not possible, apply input sanitization to the query parameter in search_result.php and ensure all SQL queries use parameterized statements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart