CVE-2026-45418: ClipBucket: Blind SQL Injection in subtitle_edit.php

Synopsis

Blind SQL injection in ClipBucket v5 affects the subtitle editing endpoint (subtitle_edit.php). The vulnerability is reachable over the network by any authenticated user with video-upload privileges, requiring no elevated permissions. Successful exploitation allows an attacker to exfiltrate sensitive data from the underlying database using boolean-based blind SQL injection techniques. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable subtitle_edit.php endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the ClipBucket instance.

• AuthenticationRequired

  Any low-privilege account with video-upload capability is sufficient; no admin or elevated role is needed.

• Victim interactionNot required

  The attacker sends crafted POST requests directly to the endpoint; no action from another user is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the injected payload targets a straightforward numeric parameter with no race conditions or environmental dependencies.

Blast Radius

• Reads sensitive database contents including user credentials, session tokens, and stored personal data via boolean-based blind SQL injection queries.
• Enumerates database schema to identify and extract records from any table the application database user can access.
• With sufficient database privileges, the attacker may be able to read additional application secrets or configuration values persisted in the database.