Multiple SQL injection vulnerabilities in ClipBucket 2.6 Revision 738 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in an addfriend action to ajax.php; id parameter in a (2) shareobject, (3) addtofav, (4) rating, or (5) flagobject action to ajax.php; cid parameter in an (6) addnewitem, (7) removecollectionitem, (8) getitem, or (9) loadmoreitems action to ajax.php; (10) ciid parameter in a getitem action to ajax.php; user parameter to (11) usercontacts.php or (12) viewchannel.php; (13) pid parameter to viewpage.php; (14) tid parameter to viewtopic.php; or (15) v parameter to watchvideo.php.