Technical impact
The flaw is a time‑based blind SQL injection that occurs in the language update feature of ClipBucket v5. The language_id parameter is concatenated directly into the WHERE clause of an UPDATE statement without proper escaping. An administrator who holds basic_settings permission can provide a malicious payload that forces the database to execute arbitrary SQL, enabling data extraction or modification and compromising database integrity and confidentiality. The weakness maps to CWE‑89, an improper input validation that can lead to data tampering.
Affected Systems
Versions of ClipBucket v5 up through 5.5.3‑#197, distributed by MacWarrior, are affected. The vulnerability exists in the update_language processing path referenced in lang.class.php. No later releases beyond #197 are listed as affected.
Risk and Exploitability
The CVSS score of 7 indicates a high severity. EPSS is not available, and the vulnerability is not in CISA’s KEV catalog. Because the exploit requires authenticated administrator access, the practical likelihood of exploitation is moderate, depending on the organization’s admin privileges and visibility of the language_id parameter. In scenarios where administrators have unrestricted access to this function and there is no additional access control, the risk escalates to medium‑high.
