CVE-2026-77927: ClipBucket Blind SQL Injection Vulnerability

CVE-2026-77927 Overview

CVE-2026-77927 is a blind SQL injection vulnerability in ClipBucket v5 versions prior to 5.5.3-#182. Authenticated attackers can submit the check_photo parameter as an array to bypass the clean_requests() sanitization routine in ClipBucket.class.php. The unsanitized array elements flow through the bulk deletion handler in manage_photos.php into photo_exists() within photos.class.php. There, non-numeric values are interpolated directly into a SQL query, enabling time-based blind SQL injection. The flaw is tracked under CWE-89.

Critical Impact
Authenticated attackers can extract credential hashes and other sensitive database contents via time-based blind SQL injection through the photo deletion endpoint.

Affected Products

ClipBucket v5 versions before 5.5.3-#182
Deployments exposing manage_photos.php bulk deletion functionality
Any ClipBucket installation permitting authenticated user access to photo management

Discovery Timeline

2026-09-18 - CVE-2026-77927 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77927

Vulnerability Analysis

The vulnerability originates in ClipBucket's sanitization layer. The clean_requests() function in ClipBucket.class.php sanitizes scalar request parameters but fails to recursively process arrays. An attacker who submits check_photo as an array bypasses input cleaning entirely.

The bulk deletion handler in manage_photos.php iterates over the tainted array and passes each element to photo_exists() in photos.class.php. Inside photo_exists(), the code branches on is_numeric($id). When the value is non-numeric, it is concatenated directly into a SQL WHERE clause without escaping or parameterization.

Because the endpoint does not return SQL errors or query results to the requester, exploitation relies on time-based blind techniques using payloads such as SLEEP() to infer data one bit at a time. Attackers can systematically extract administrator password hashes and other stored credentials.

Root Cause

The root cause is missing type validation and input sanitization on array-shaped request parameters, combined with direct string interpolation of user input into a SQL query. The is_numeric() check gates the vulnerable branch but does not sanitize the non-numeric input path.

Attack Vector

Exploitation requires an authenticated session with access to the photo management interface. The attacker crafts an HTTP POST to manage_photos.php where check_photo[] contains SQL payloads instead of a numeric photo identifier. The server interpolates the payload into a query against the photos table and executes it.

php

// Security patch in upload/includes/classes/photos.class.php
function photo_exists($id): bool
{
    if (is_numeric($id)) {
-        $result = Clipbucket_db::getInstance()->select(tbl($this->p_tbl), 'photo_id', ' photo_id = ' . (int)$id);
+        $cond = ' photo_id = ' . (int)$id;
    } else {
-        $result = Clipbucket_db::getInstance()->select(tbl($this->p_tbl), 'photo_id', ' photo_key = \'' . $id . '\'');
+        $cond = ' photo_key = \'' . mysql_clean($id) . '\'';
    }

+    $result = Clipbucket_db::getInstance()->select(tbl($this->p_tbl), 'photo_id', $cond);
    if ($result) {
        return true;
    }
}
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/136dd2e4e73123f137478c72308e8c1d7be45a97

The patch wraps the non-numeric branch with mysql_clean() before interpolation, closing the injection sink.

Detection Methods for CVE-2026-77927

Indicators of Compromise

HTTP POST requests to manage_photos.php containing check_photo[] array parameters with non-numeric values
Request bodies containing SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or SUBSTRING in the check_photo parameter
Anomalously long response times from manage_photos.php endpoints, consistent with time-based blind SQLi
Repeated authenticated requests from a single session iterating over character positions or bit values

Detection Strategies

Deploy web application firewall rules that inspect array-shaped request parameters against the photo management endpoints
Enable MySQL general query log or slow query log to capture unusual photo_key WHERE clauses containing SQL functions
Correlate authenticated user activity with elevated request latency on /actions/manage_photos.php
Monitor for outbound DNS or HTTP callbacks originating from the database host, which may indicate out-of-band exfiltration attempts

Monitoring Recommendations

Alert on any HTTP parameter parser detecting check_photo as an array type in access logs
Track authenticated sessions that generate high volumes of requests to photo management endpoints within short intervals
Baseline normal response times for manage_photos.php and alert on statistical deviations that suggest SLEEP()-based probes

How to Mitigate CVE-2026-77927

Immediate Actions Required

Upgrade ClipBucket v5 to release 5.5.3-#182 or later, which contains the fix in commit 136dd2e4e73123f137478c72308e8c1d7be45a97
Audit authenticated user accounts and rotate any credentials that may have been exposed via the photos table
Review web server access logs for the indicators listed above to identify prior exploitation attempts
Restrict access to the ClipBucket administrative and photo management interfaces to trusted networks where feasible

Patch Information

The fix ships in ClipBucket v5 release 5.5.3-#182. The upstream commit modifies photo_exists() to route non-numeric identifiers through mysql_clean() before SQL interpolation. See the VulnCheck advisory for additional technical context.

Workarounds

Deploy a WAF rule that rejects requests to manage_photos.php when check_photo is submitted as an array
Apply the upstream patch to photos.class.php manually if a full version upgrade is not immediately feasible
Temporarily disable the bulk photo deletion feature or restrict it to a single trusted administrator account

bash

# Example ModSecurity rule to block array-typed check_photo parameters
SecRule REQUEST_URI "@contains manage_photos.php" \
    "chain,id:1077927,phase:2,deny,status:403,msg:'CVE-2026-77927 ClipBucket SQLi attempt'"
    SecRule ARGS_NAMES "@rx ^check_photo\[" \
        "chain"
        SecRule ARGS:'/^check_photo\[.*\]$/' "@rx [^0-9]"