CVE-2026-77928: ClipBucket 5.5.3 Blind SQL Injection via Private Message Deletion Endpoint
ClipBucket v5 through 5.5.3 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests() sanitization function in ClipBucket.class.php. Attackers can pass unsanitized array elements through the deletion handler in privatemessage.php into cbpm::deletemsg(), which interpolates the unescaped message ID directly into a SQL query string, enabling time-based blind SQL injection to retrieve all user credential hashes and email addresses.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a ClipBucket user and able to submit requests to the private-message deletion handler. No user interaction is required.
What data could be exposed?
The blind SQL injection can be used to extract arbitrary database contents. The reported impact specifically includes user credential hashes and email addresses.
Which deployments are affected?
ClipBucket versions 5 through 5.5.3 are identified as affected. The vulnerable path is the private-message deletion endpoint handling the msg_id parameter.
How does exploitation bypass input sanitization?
The attacker supplies msg_id as an array, allowing array elements to bypass the clean_requests() sanitization function. An unsanitized element reaches cb_pm::delete_msg(), where it is directly interpolated into a SQL query.