CVE-2026-45060: ClipBucket: Blind SQL Injection in progress_video.php

Synopsis

Blind SQL injection in ClipBucket v5 allows any unauthenticated remote attacker to inject arbitrary SQL through the ids parameter of the actions/progress_video.php endpoint. The service is reachable over the network and requires no credentials or user interaction to exploit. Successful exploitation gives the attacker full read and write access to the underlying database as well as the ability to disrupt availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the service via HTTP from any internet or internal network origin.

• AuthenticationNot required

  No credentials of any privilege level are required; the injection is reachable by fully anonymous requests.

• Victim interactionNot required

  The attacker sends requests directly to the server and no user action or social engineering is needed to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory-layout dependencies, or special environmental factors need to align.

Blast Radius

• Reads all database content, including user credentials, session tokens, private video metadata, and any stored personal or payment data.
• Modifies or deletes persisted database rows, enabling account takeover, content manipulation, or destruction of platform data.
• Crashes or degrades the database-dependent service, taking the video platform offline.
• Enables potential pivoting to other internal services if database credentials or connection strings are recoverable from the schema.