ClipBucket v5, versions 5.5.2-#187 and older, contains a blind SQL injection flaw that allows an attacker to supply a specially crafted value for the obj_id parameter in the /actions/ajax.php endpoint. The value is concatenated directly into a database count query without validation, enabling attackers to read or manipulate database content. This results in serious confidentiality compromise, with potential for further escalation if additional weaknesses exist.

All installations of the ClipBucket v5 content management system running version 5.5.2-#187 or earlier are affected. The vulnerability is present in the default open source package and does not require any custom configuration changes.

The vulnerability is rated CVSS 9.8, indicating a high severity with full threat impact. The EPSS score of less than 1% suggests a low probability of exploitation in the near term, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw through web traffic, potentially requiring authenticated access to the comment posting interface; the vector is inferred to be web-based (HTTP POST). Once compromised, attackers can extract sensitive data and potentially execute additional commands within the database.