ClipBucket V5 Ad Deletion Time-Blind SQLi Vulnerability (CVE-2026-103766) Analysis

Vulnerability Overview Title: Time-based Blind SQL Injection Vulnerability in the Ad Deletion Function of ClipBucket V5 Product: ClipBucket V5 Affected Versions: <= 5.5.3 - #197 CVE ID: CVE-2026-103766 Description: A time-based blind SQL injection vulnerability exists in the ad deletion function of ClipBucket v5.5.3 - #197. Authenticated users with the permission can inject arbitrary SQL via the GET parameter in . The injected payload is directly concatenated into the statement without any sanitization, escaping, or parameterized query protection, allowing attackers to execute arbitrary SQL queries against the database (e.g., exploiting via for time-based blind injection). The same unsanitized input is also used in the pre-check query, meaning the injection is triggered twice per request. Impact Scope Arbitrary SQL Query Execution: The vulnerability allows the execution of arbitrary SQL queries against the database. Sensitive Data Extraction: Authenticated users with permissions can extract sensitive data (user credentials, email addresses, private video metadata). Modification or Deletion of Database Records: Arbitrary database records can be modified or deleted. Remote Code Execution (RCE): RCE may be achieved via MySQL's or UDF (User-Defined Function) mechanisms. Remediation Patch Submission: See here Proof of Concept (PoC) Code Prerequisites ClipBucket version v5.5.3 - #197 Authenticated administrator session with permissions At least one ad existing in the table (e.g., ) Step 1 - Baseline (No Injection) Expected response time: < 1 second. Step 2 - Time-Based Blind SQL Injection URL-decoded payload: Response time is approximately 5 seconds, confirming the SQL injection. Code Details Sink (lines 102-110) Pre-check (lines 293-300) — Also Vulnerable HTTP Entry Point ( , lines 26-28) Summary This vulnerability allows arbitrary SQL query execution via time-based blind SQL injection, affecting ClipBucket V5 versions <= 5.5.3 - #197. The remediation involves patch submission, details available here.

Goal Reached Thanks to every supporter — we hit 100%!

ClipBucket V5 Ad Deletion Time-Blind SQLi Vulnerability (CVE-2026-103766) Analysis