CVE-2026-77927 Details

A blind SQL injection vulnerability has been identified in ClipBucket version 5 prior to 5.5.3-#182. This vulnerability allows authenticated users to extract arbitrary data from the database. The issue arises in the photo management feature, specifically through the bulk deletion handler in 'manage_photos.php'. Users can submit the 'check_photo' parameter as an array, bypassing the 'clean_requests()' sanitization function in 'ClipBucket.class.php'. Unsanitized array elements are then passed to the 'photo_exists()' function in 'photos.class.php', where they are interpolated directly into a SQL query. This exploitation enables time-based blind SQL injection, allowing attackers to retrieve credential hashes and other sensitive information from the database.

Users are advised to update to ClipBucket version 5.5.3-#182 or later, where this vulnerability has been addressed.