An authenticated SQL injection vulnerability in ClipBucket v5 versions prior to 5.5.3 #80 poses a severe risk of database compromise and potential administrative account takeover.

The application is susceptible to a time-based blind SQL injection (CWE-89) within the actions/ajax.php endpoint. By failing to properly sanitize the userid parameter, the software allows an authenticated attacker to inject and execute arbitrary SQL commands against the backend database.

The ability to perform SQL injection attacks against a video platform can lead to the complete exposure of sensitive user data, intellectual property, and system credentials. Given the CVSS score of 8.8, this vulnerability is considered high risk, as it permits unauthorized database disclosure and may facilitate full administrative takeover of the platform. Such a compromise would likely result in significant operational disruption and loss of user trust.

Immediate Action: Upgrade to ClipBucket version 5.5.3 #80 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Monitor application logs for unusual database query patterns or high volumes of time-based response anomalies originating from the actions/ajax.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP requests targeting the actions/ajax.php endpoint.

Public Exploit Available: Yes — a public proof-of-concept repository is available on GitHub.

This vulnerability represents a significant security risk for all organizations hosting ClipBucket v5. Administrators must prioritize the application of the vendor-provided patch to remediate the SQL injection flaw. Failure to address this issue leaves the backend database exposed to unauthorized manipulation and potential full system compromise.