CVE-2026-77928: ClipBucket SQL Injection Vulnerability

CVE-2026-77928 Overview

CVE-2026-77928 is a blind SQL injection vulnerability [CWE-89] in ClipBucket v5 versions prior to 5.5.3-#182. The flaw resides in the private message deletion handler, where the msg_id parameter can be submitted as an array to bypass the clean_requests() sanitization function in ClipBucket.class.php. Authenticated attackers can extract arbitrary database contents, including user credential hashes and email addresses, through time-based blind SQL injection.

Critical Impact
Any authenticated ClipBucket user can exfiltrate full database contents, including password hashes and email addresses, by sending a crafted array parameter to the message deletion endpoint.

Affected Products

ClipBucket v5 versions before 5.5.3-#182
The private_message.php deletion handler
The cb_pm::delete_msg() method interpolating msg_id into SQL

Discovery Timeline

2026-09-18 - CVE-2026-77928 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77928

Vulnerability Analysis

The vulnerability exists in ClipBucket v5's private messaging subsystem. When a user requests deletion of a private message, the private_message.php handler forwards the msg_id parameter to the cb_pm::delete_msg() method. That method concatenates the parameter directly into a SQL query without escaping or parameterization.

ClipBucket relies on the clean_requests() function in ClipBucket.class.php to sanitize request parameters globally. However, clean_requests() operates on scalar string values and does not recursively sanitize array elements. Attackers exploit this gap by submitting msg_id as an array, which passes through sanitization unmodified and reaches the vulnerable query.

Because the deletion endpoint does not return query results directly, attackers use time-based inference. A payload that conditionally invokes SLEEP() or BENCHMARK() reveals data one bit at a time through response latency, enabling extraction of the entire users table.

Root Cause

The root cause is inadequate input sanitization combined with unsafe SQL string interpolation. The clean_requests() routine assumes scalar inputs, so array-typed request parameters bypass filtering. cb_pm::delete_msg() compounds the flaw by building queries with string concatenation instead of prepared statements, satisfying the conditions for [CWE-89] SQL Injection.

Attack Vector

The attack requires network access and a valid authenticated session on the target ClipBucket instance. An attacker submits a POST request to the private message deletion endpoint with msg_id[] structured as an array containing SQL payload fragments. The server processes the array element inside the DELETE query, causing time-based side effects that leak database contents.

text

// Security patch reference - upload/changelog/553.json
 {
   "version":"5.5.3",
-  "revision":"178",
+  "revision":"179",
   "status":"stable",
   "detail":[
     {
// Source: https://github.com/MacWarrior/clipbucket-v5/commit/85907c5fd1205ccae98c214bed4b3421c632f90c
// Changelog entry: "Miscellaneous : Fix possible SQL injection (Thanks @QwesiRED !), Cleanup code"

Detection Methods for CVE-2026-77928

Indicators of Compromise

HTTP POST requests to private_message.php containing array-style parameters such as msg_id[]= in the request body
Request payloads that include SQL keywords such as SLEEP, BENCHMARK, SELECT, UNION, or IF( within msg_id values
Anomalous latency in responses from the message deletion endpoint, particularly repeated requests with incrementally changing payloads

Detection Strategies

Inspect web server access logs for msg_id[] array notation directed at ClipBucket handlers
Deploy web application firewall rules that flag array-typed parameters where the application expects scalar integer IDs
Correlate authenticated user sessions with high-volume repetitive POST traffic to private_message.php, a signature of blind SQLi enumeration

Monitoring Recommendations

Enable MySQL general query logging on the ClipBucket database and alert on DELETE statements containing SLEEP( or BENCHMARK(
Track outbound HTTP response times from the deletion endpoint and alert on latency spikes consistent with time-based injection
Monitor for unusual read patterns against the users table, especially queries that select password or email columns from authenticated sessions

How to Mitigate CVE-2026-77928

Immediate Actions Required

Upgrade ClipBucket v5 to release 5.5.3-#182 or later, which contains the upstream fix in commit 85907c5
Audit application logs for prior exploitation attempts targeting private_message.php and rotate all user credentials if evidence of extraction is found
Restrict access to authenticated ClipBucket features via IP allowlists or reverse proxy authentication until patching is complete

Patch Information

The vendor released the fix in the ClipBucket 5.5.3-#182 release. The corresponding upstream commit 85907c5 addresses the SQL injection and includes broader code cleanup. Full technical analysis is available in the VulnCheck SQL Injection Advisory.

Workarounds

If immediate patching is not possible, add a web application firewall rule to reject any request to ClipBucket endpoints where msg_id is submitted as an array
Temporarily disable the private messaging feature by removing or restricting access to private_message.php at the web server level
Enforce type coercion on msg_id in a custom pre-handler that casts the value to an integer before ClipBucket processes the request

bash

# Example nginx rule to block array-typed msg_id parameters
location ~ /private_message\.php$ {
    if ($args ~* "msg_id(\[|%5B)") {
        return 403;
    }
    if ($request_body ~* "msg_id(\[|%5B)") {
        return 403;
    }
}