CVE-2026-42847

Vulnerability

ClipBucket v5 prior to 5.5.3 - #122 contains a SQL injection vulnerability in the admin endpoint admin_area/action_logs.php. The type parameter from $_GET is stored into $result_array['type'] and passed to fetch_action_logs(), where it is directly concatenated into a SQL WHERE condition without parameterization. This allows an attacker to break out of the intended string context and inject arbitrary SQL [1].

Exploitation

Exploitation requires an authenticated admin session. The endpoint enforces admin access via User::getInstance()->hasPermissionOrRedirect('admin_access', true). An attacker with valid admin credentials can send a crafted HTTP GET request to admin_area/action_logs.php with a malicious type parameter, such as a UNION-based injection payload, to extract data from the database [1].

Impact

Successful exploitation allows an authenticated admin attacker to perform UNION-based SQL injection, leading to exfiltration of arbitrary data from the backend database. This results in high confidentiality impact, as sensitive information can be read [1].

Mitigation

The vulnerability is fixed in version 5.5.3 - #122. Users should update to this version or later. No workaround is available besides applying the patch [1].