CVE-2026-45418: ClipBucket v5 SQL Injection in Subtitle Editor

Technical summary

CVE-2026-45418 is a boolean-based blind SQL injection vulnerability in ClipBucket v5's subtitle management functionality. The vulnerability exists in the POST request handler at `/actions/subtitle_edit.php`, which processes a 'number' parameter without proper input validation or parameterized query construction. An authenticated attacker can craft SQL payloads within this parameter to execute arbitrary database queries. The boolean-based nature of the injection allows attackers to systematically extract data by observing application behavior differences based on true/false SQL conditions. The vulnerability requires authentication and the ability to upload videos, but imposes no UI interaction requirement once authenticated.

Business impact

This vulnerability poses significant risk to ClipBucket deployments because it enables authenticated attackers to exfiltrate sensitive database contents, including user credentials, personal information, and platform configuration data. Organizations running vulnerable ClipBucket instances may face data breach exposure, potential regulatory compliance violations (GDPR, CCPA, etc.), reputational damage, and operational disruption. The attack requires only basic technical knowledge of SQL injection techniques and can be automated for rapid data extraction. Customer trust and platform integrity are directly threatened by successful exploitation.

Affected systems

ClipBucket v5 versions prior to 5.5.3 - #132 are vulnerable. The vulnerability affects all installations where authentication is enabled and users can upload videos. Self-hosted ClipBucket instances are the primary concern; organizations should immediately identify which versions are deployed in their environments. The open-source nature of ClipBucket means vulnerability may exist across numerous independent deployments without central tracking.

Exploitability

Exploitability is moderate-to-high within the attack scope. The vulnerability requires valid authentication credentials and video upload permissions, which limits opportunistic external attacks but aligns with typical insider-threat or compromised-account scenarios. Boolean-based blind SQL injection is slower than error-based or union-based variants but remains reliably exploitable. No sophisticated tools are required—attackers can use standard HTTP clients and basic SQL injection payloads. The attack leaves database query logs that may be detectable through security monitoring if baseline logging is in place.

Remediation

Organizations running ClipBucket v5 must upgrade to version 5.5.3 - #132 or later. This patched version addresses the input validation vulnerability and implements secure query handling in the subtitle editing endpoint. After patching, conduct a database audit to identify any unauthorized access or data exfiltration during the vulnerable window. Review authentication logs and database query logs for suspicious activity. Consider implementing principle-of-least-privilege on database accounts used by ClipBucket to limit blast radius of future injection vulnerabilities.

Patch guidance

Download and apply ClipBucket version 5.5.3 - #132 from the official project repository or release channel. Follow the vendor's upgrade procedures carefully, including database migration steps if any schema changes are present. Test the patched version in a staging environment before production deployment to validate functionality and compatibility with your instance configuration. If using a managed ClipBucket service, verify your provider has released and deployed the patched version. Rollback procedures should be documented before applying patches to production systems.

Detection guidance

Monitor for suspicious HTTP POST requests to `/actions/subtitle_edit.php` containing SQL keywords or encoded payloads in the 'number' parameter (e.g., 'OR', 'UNION', 'SELECT', 'SLEEP', 'BENCHMARK'). Enable database query logging if not already active, and review logs for unusual patterns such as multiple INFORMATION_SCHEMA queries, time-based delays, or SELECT statements executed by the ClipBucket application user. Network intrusion detection systems (IDS) should be tuned to detect SQL injection signatures in HTTP request bodies. Web application firewalls (WAF) can block requests with SQL injection patterns before reaching the application. Review access logs for authenticated users accessing subtitle endpoints with abnormal frequency or timing.

Why prioritize this

This vulnerability merits immediate patching priority due to its HIGH CVSS score (8.8), low authentication barrier relative to insider threat models, and direct data exfiltration risk. The boolean-based blind SQL injection technique, while slower than other variants, is reliably exploitable and enables complete database compromise. Organizations with customer or regulated data stored in ClipBucket instances face significant breach risk. The vulnerability has been patched, making remediation straightforward and risk reduction immediate upon upgrade.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: (1) network-accessible attack vector; (2) low attack complexity requiring no special conditions; (3) low privilege requirement (authenticated user with upload capability); (4) no user interaction needed; (5) high confidentiality impact through data exfiltration; (6) high integrity impact through potential data modification via SQL injection; (7) high availability impact through potential resource exhaustion or database corruption. The score appropriately elevates the vulnerability above medium severity due to the combination of broad data access and integrity risks.

Frequently asked questions