ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
Résumé
ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute arbitrary SQL queries, leading to full database disclosure and potential administrative account takeover. Version 5.5.3 #80 fixes the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com