CVE-2026-102569: ClipBucket SQL Injection Vulnerability

CVE-2026-102569 Overview

CVE-2026-102569 is a time-based blind SQL injection vulnerability in ClipBucket v5 through version 5.5.3-#197. The flaw resides in the admin video edit function, where the videoid parameter is concatenated into an UPDATE statement without proper escaping or type casting. An authenticated administrator holding the video_moderation permission can inject arbitrary SQL statements to read or modify database contents. The weakness maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
An authenticated admin with video_moderation permission can extract or tamper with arbitrary database records, including credential hashes and video metadata, through blind SQL injection in the videoid parameter.

Affected Products

ClipBucket v5 (all versions up to and including 5.5.3-#197)
Component: upload/includes/classes/video.class.php
Admin video edit workflow that consumes the videoid parameter

Discovery Timeline

2026-09-29 - CVE-2026-102569 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102569

Vulnerability Analysis

The vulnerability exists in the video update logic of video.class.php. When an administrator submits an edit request, the application reads the videoid field from the request array and assigns it directly to $vid without validation. The value is then interpolated into an UPDATE SQL statement executed against the ClipBucket database. Because the input is not cast, escaped, or parameterized, a crafted string terminates the intended SQL context and appends attacker-controlled clauses.

Exploitation is time-based and blind. The attacker infers query results by injecting conditional SLEEP() payloads and measuring server response latency. Successful exploitation permits enumeration of the cb_users table, extraction of password hashes, or arbitrary modification of video records. The attack requires an authenticated admin account with video_moderation privileges, limiting exposure to insider threats or accounts compromised through credential reuse or phishing.

Root Cause

The root cause is missing input validation on the videoid parameter. The pre-patch code reads the value directly ($vid = $array['videoid'];) and passes it into a dynamically constructed SQL string. Integer coercion or prepared statements were not applied at the injection point.

Attack Vector

The attack vector is network-based against the admin panel. An authenticated administrator sends a crafted POST request to the video edit endpoint with a payload embedded in the videoid field. The payload uses conditional time delays to exfiltrate data character-by-character.

php

            }
 
            if (isset($array['videoid'])) {
-                $vid = $array['videoid'];
+                $vid = (int)$array['videoid'];
            } else {
                if (isset($array['file_name'])) {
                    $params = [

Source: GitHub commit 1c30d0b. The fix casts the parameter to an integer using (int), neutralizing SQL metacharacters before interpolation.

Detection Methods for CVE-2026-102569

Indicators of Compromise

HTTP POST requests to the ClipBucket admin video edit endpoint containing SQL keywords such as SLEEP(, BENCHMARK(, UNION SELECT, or comment sequences -- and /* inside the videoid parameter.
Anomalous MySQL query execution times originating from the admin video moderation workflow.
Web server logs showing repeated admin requests with incrementally varying videoid values within short time windows.

Detection Strategies

Inspect web server access logs for videoid values that are not purely numeric.
Enable MySQL general or slow query logging and alert on UPDATE video statements containing SLEEP or nested SELECT subqueries.
Deploy a web application firewall rule targeting non-integer input on admin video edit parameters.

Monitoring Recommendations

Track authentication events for accounts holding the video_moderation role and flag off-hours or geographically anomalous logins.
Correlate admin session activity with database query latency spikes on the ClipBucket schema.
Forward web and database logs to a centralized platform such as Singularity Data Lake for cross-source correlation and retention.

How to Mitigate CVE-2026-102569

Immediate Actions Required

Apply the upstream patch from commit 1c30d0b or upgrade to a ClipBucket release that includes the integer cast on videoid.
Audit all accounts assigned the video_moderation permission and revoke unnecessary privileges.
Rotate administrator credentials and any database credentials that may have been exposed through prior exploitation.

Patch Information

The vendor fix is committed to the MacWarrior/clipbucket-v5 repository. The patch modifies upload/includes/classes/video.class.php around line 1972 to enforce integer casting on the videoid value before it enters the SQL statement. See the VulnCheck advisory and the HackMD technical analysis for exploitation details.

Workarounds

Restrict access to the ClipBucket admin panel by IP allowlist or VPN until the patch is deployed.
Enforce multi-factor authentication on all administrative accounts to reduce risk from credential compromise.
Deploy a WAF rule that rejects non-numeric values submitted to the videoid parameter on admin video edit routes.

bash

# Example ModSecurity rule to block non-integer videoid values
SecRule ARGS:videoid "!@rx ^[0-9]+$" \
    "id:1026102569,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-102569: Non-integer videoid parameter blocked'"