CVE-2018-7666: SQL Injection
An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/votechannel.php channelId parameter, the ajax/commonAjax.php email parameter, and the ajax/commonAjax.php username parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ClipBucketto a version that resolves this vulnerability.Fixed in 4.0.0 Release 4902 - Configuration
Update code handling for actions/vote_channel.php channelId parameter to use safe, parameterized queries (avoid SQL injection).
ClipBucket (actions/vote_channel.php) channelId parameter input handling = validate and parameterize channelId to prevent SQL injection - Configuration
Update code handling for ajax/commonAjax.php email parameter to use safe, parameterized queries (avoid SQL injection).
ClipBucket (ajax/commonAjax.php) email parameter input handling = validate and parameterize email to prevent SQL injection - Configuration
Update code handling for ajax/commonAjax.php username parameter to use safe, parameterized queries (avoid SQL injection).
ClipBucket (ajax/commonAjax.php) username parameter input handling = validate and parameterize username to prevent SQL injection
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7666?
CVE-2018-7666 is classified as a critical vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2018-7666?
To fix CVE-2018-7666, upgrade ClipBucket to version 4.0.0 or later to eliminate the SQL injection vulnerabilities.
What are the specific vulnerabilities in CVE-2018-7666?
CVE-2018-7666 includes SQL injection vulnerabilities in the actions/vote_channel.php channelId parameter and the ajax/commonAjax.php email and username parameters.
Which versions of ClipBucket are affected by CVE-2018-7666?
CVE-2018-7666 affects all ClipBucket versions prior to 4.0.0 Release 4902.
How can CVE-2018-7666 impact a web application?
CVE-2018-7666 can allow attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access or manipulation.