SQL Injection in ClipBucket Custom Fields plugin (GHSA-4g7x-j562-8g69)

Critical Vulnerability Information Vulnerability Title SQL Injection in ClipBucket Custom Fields plugin Vulnerability ID GHSA-4g7x-j562-8g69 Risk Level Moderate (6.5/10) Affected Versions = 5.5.2 - #152 Description SQL Injection vulnerabilities in the ClipBucket Custom Fields plugin allow authenticated administrators with plugin management privileges to execute arbitrary SQL commands against the database. The vulnerabilities require the Custom Fields plugin to be installed and accessible, and can only be exploited by users with administrative access to the plugin interface. Vulnerability Details Authentication Required: Yes (Administrator privileges) Plugin Dependency: Custom Fields plugin must be installed and enabled Vulnerable Code Locations: - function - function Root Cause Analysis 1. Direct String Concatenation in SQL: The function constructs SQL queries by directly concatenating user input without any sanitization. 2. Missing Input Validation: No validation or sanitization of the , , , , , and parameters. 3. Unsafe WHERE Clause Construction: The function directly interpolates into the WHERE clause. 4. No Prepared Statements: Functions use raw SQL execution instead of parameterized queries. Impact Vulnerability Type: SQL Injection (authenticated) Affected Users: Administrators with plugin management access Prerequisites: Custom Fields plugin installation and admin privileges Technical Impact Database read access to sensitive information Potential data modification within admin context Information disclosure of database structure and contents Privilege escalation within the database scope Limitations Requires authenticated administrative access Limited to environments where Custom Fields plugin is installed Exploitation scope constrained by admin user database permissions No direct system-level access or remote code execution Risk Assessment This is a Medium severity vulnerability due to the authentication requirement and plugin dependency. While the technical impact can be significant within the database context, the practical risk is reduced by the need for administrative credentials and the specific plugin installation requirement.

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection in ClipBucket Custom Fields plugin (GHSA-4g7x-j562-8g69)

More from this source