CVE-2026-102570: ClipBucket Time-Based Blind SQLi Flaw

CVE-2026-102570 Overview

CVE-2026-102570 is a time-based blind SQL injection vulnerability in ClipBucket v5 through version 5.5.3-#197. The flaw resides in the language update function, where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator holding the basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated administrators can read or tamper with any data in the ClipBucket database, including credentials, session data, and content metadata.

Affected Products

ClipBucket v5 releases up to and including 5.5.3-#197
Deployments using upload/includes/classes/lang.class.php before the patch commit
Self-hosted ClipBucket v5 video-sharing platform installations

Discovery Timeline

2026-09-29 - CVE-2026-102570 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102570

Vulnerability Analysis

The defect exists in the language management routine of ClipBucket v5. The application accepts a user-supplied language_id value from the administrator interface and passes it directly into a SQL UPDATE statement. Because the value is placed inside a single-quoted string via concatenation rather than a parameterized query, an attacker can break out of the quoted context and append arbitrary SQL. Since the query returns no direct response to the client, the flaw is exploited as a time-based blind injection using functions such as SLEEP() to infer values one bit at a time. Successful exploitation lets an authenticated user with the basic_settings permission enumerate arbitrary tables and rewrite records. Additional analysis is available in the HackMD SQLi Analysis for ClipBucket and the VulnCheck SQL Injection Advisory.

Root Cause

The underlying issue is missing input neutralization. The vulnerable call built the WHERE clause using string concatenation with $array['language_id'], a value that originates from the HTTP request. No type casting, allowlist validation, or prepared statement was applied before the value reached the database driver.

Attack Vector

Exploitation requires an authenticated session with the basic_settings administrative permission. The attacker submits a crafted language_id parameter to the language update endpoint. Payloads containing SQL fragments and timing primitives allow blind exfiltration of database contents over the network.

php

// Vulnerable code and patch from lang.class.php (line ~365)
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/ecbdf2d534ac7ef34a5a34e6e4c198da57d0c12c

         } elseif (empty($array['flag'])) {
             e(lang('lang_flag_empty'));
         } else {
-            Clipbucket_db::getInstance()->update(tbl('languages'),
-                ['language_name', 'language_code', 'language_flag'],
-                [$array['name'], $array['code'], $array['flag']],
-                ' language_id=\'' . $array['language_id'] . '\'');
+            Clipbucket_db::getInstance()->update(tbl('languages'),
+                ['language_name', 'language_code', 'language_flag'],
+                [$array['name'], $array['code'], $array['flag']],
+                ' language_id=\'' . $lang['language_id'] . '\'');
             e(lang('lang_updated'), 'm');
             CacheRedis::flushAll();
         }

The patch replaces the attacker-controlled $array['language_id'] with $lang['language_id'], a server-side lookup value that is not sourced from the HTTP request.

Detection Methods for CVE-2026-102570

Indicators of Compromise

Unusual POST requests to the ClipBucket language administration endpoint containing SQL keywords such as SLEEP, BENCHMARK, UNION, or SELECT in the language_id field.
Repeated language update requests from a single administrator session with response times that scale linearly with payload size.
Web server or PHP-FPM slow-query logs recording UPDATE statements against the languages table with anomalous execution times.

Detection Strategies

Enable database query logging and alert on UPDATE statements targeting the languages table that contain SQL syntax within literal values.
Deploy a web application firewall rule that inspects the language_id parameter and blocks non-numeric input.
Correlate administrator authentication events with sustained bursts of language update requests to flag credential misuse.

Monitoring Recommendations

Retain HTTP access logs for the /admin_area/ path and forward them to a central analytics platform for query-parameter analysis.
Monitor MySQL general and slow query logs for statements matching the vulnerable language_id='...' pattern.
Track modifications to the admin and users tables that follow language update activity, since these often indicate post-exploitation tampering.

How to Mitigate CVE-2026-102570

Immediate Actions Required

Upgrade ClipBucket v5 to a build that includes commit ecbdf2d534ac7ef34a5a34e6e4c198da57d0c12c.
Rotate credentials for all accounts with the basic_settings permission and audit recent administrator activity.
Review the languages table and other sensitive tables for unauthorized modifications.

Patch Information

The upstream fix is available in the ClipBucket v5 GitHub repository. The patched code path is visible at lang.class.php line 365. Operators building from source should pull the latest main branch and redeploy.

Workarounds

Restrict access to the /admin_area/ interface using network ACLs or an authenticating reverse proxy until patching completes.
Reduce the number of accounts granted basic_settings permission to the minimum required.
Place a WAF rule in front of ClipBucket that enforces numeric-only values for the language_id parameter.

bash

# Example nginx location block restricting admin access to a trusted CIDR
location /admin_area/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://clipbucket_backend;
}