CVE-2026-96272: ClipBucket v5 Blind SQL Injection Vulnerability

CVE-2026-96272 Overview

CVE-2026-96272 is a blind SQL injection vulnerability in ClipBucket v5 versions before 5.5.3-#182. The flaw resides in the photo search endpoint, where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can leverage time-based blind SQL injection techniques against the public search functionality. Successful exploitation allows extraction of usernames, email addresses, and administrator password hashes, enabling full account takeover. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can extract administrator password hashes from the database and take over ClipBucket administrator accounts.

Affected Products

ClipBucket v5 versions prior to 5.5.3-#182
Deployments exposing the photo search functionality (search_result.php)
Self-hosted ClipBucket video sharing platform instances

Discovery Timeline

2026-09-23 - CVE-2026-96272 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96272

Vulnerability Analysis

The vulnerability exists in the photo search handler within upload/includes/classes/photos.class.php. User-controlled input from the query parameter is concatenated directly into SQL statements without sanitization. The unsanitized value flows into both WHERE clause conditions and ORDER BY expressions used for relevance scoring. Because the endpoint returns no direct query output, exploitation relies on time-based blind techniques such as SLEEP() payloads to infer data character-by-character. Attackers can enumerate the users table to retrieve credentials and administrator password hashes, then perform offline cracking or replay attacks for account takeover.

Root Cause

The root cause is missing input sanitization in the $like_user construction inside the photos class. The $param_search variable is embedded directly into a LIKE clause and reused inside an ORDER BY MAX(CASE WHEN ...) expression. Both usage sites lacked calls to the internal mysql_clean() helper, allowing single quotes and SQL metacharacters to break out of the string literal and inject arbitrary SQL syntax.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker issues crafted HTTP requests to the photo search endpoint with malicious payloads in the query parameter. Time-based blind SQLi payloads produce observable response delays that leak boolean conditions about database contents. Automated tooling such as sqlmap can enumerate the schema and extract the users table without triggering authentication checks.

php

// Vulnerable code in upload/includes/classes/photos.class.php
// Before patch — $param_search flows into SQL unsanitized
$like_user = ' lower(users.username) LIKE \'' . $param_search . '\'';
$cond .= ' OR ' . $like_user;
$order_search .= ', MAX(CASE WHEN ' . $like_user . ' THEN 1 ELSE 0 END ) DESC ';

// After patch — mysql_clean() sanitizes the input
$like_user = ' lower(users.username) LIKE \'' . mysql_clean($param_search) . '\'';

Source: ClipBucket v5 Security Commit 7fd0af6

Detection Methods for CVE-2026-96272

Indicators of Compromise

HTTP requests to search_result.php containing SQL keywords such as SLEEP, BENCHMARK, UNION SELECT, or INFORMATION_SCHEMA in the query parameter.
Anomalously long response times from the ClipBucket photo search endpoint, consistent with time-based blind SQLi payloads.
High volume of sequential requests from a single source with incrementing payload variations targeting /photos/ search paths.
Database process logs showing long-running queries against the users table originating from the photo search handler.

Detection Strategies

Deploy web application firewall (WAF) signatures for SQL injection patterns targeting the query parameter on ClipBucket photo search URLs.
Enable MySQL general query log or slow query log to surface SLEEP() and BENCHMARK() calls from web application sessions.
Correlate web server access logs with backend query duration to identify time-based inference patterns.

Monitoring Recommendations

Alert on repeated 200-status responses to search_result.php with response times exceeding a baseline threshold.
Monitor authentication logs for administrator logins from new IP addresses or user-agents following suspicious search traffic.
Track outbound connections from the ClipBucket web server for signs of secondary payload delivery post-compromise.

How to Mitigate CVE-2026-96272

Immediate Actions Required

Upgrade ClipBucket v5 to revision 5.5.3-#182 or later, which applies mysql_clean() sanitization to the affected search parameter.
Rotate all administrator and user passwords, and invalidate active sessions, if the vulnerable version was exposed to the internet.
Audit the users table and application logs for unauthorized account modifications or new administrator accounts.

Patch Information

The vendor released a fix in commit 7fd0af6f8b5826c2d6ef0976dbb1867f5c36b707, wrapping $param_search with the mysql_clean() sanitization function inside upload/includes/classes/photos.class.php. The changelog revision was bumped from 161 to 162 in upload/changelog/553.json. Details are available in the ClipBucket Pull Request #874 and the VulnCheck Advisory.

Workarounds

Restrict access to search_result.php via WAF rules or reverse proxy ACLs until the patch can be applied.
Deploy a WAF ruleset that blocks SQL metacharacters and time-delay functions in the query parameter of photo search requests.
Temporarily disable the photo search feature if the endpoint is not business-critical.

bash

# Example nginx configuration to block obvious SQLi payloads in the query parameter
location ~* /search_result\.php$ {
    if ($arg_query ~* "(sleep\s*\(|benchmark\s*\(|union.+select|information_schema|--|/\*)") {
        return 403;
    }
    proxy_pass http://clipbucket_backend;
}