ClipBucket v5 contains a time‑based blind SQL injection flaw in the actions/ajax.php endpoint. The issue stems from insufficient input sanitization of the userid parameter, allowing an authenticated attacker to craft payloads that cause delayed responses and reveal database contents. This weakness is classified as CWE‑89. The impact of exploitation is full database disclosure and potential administrative account takeover, as the attacker can execute arbitrary SQL queries against the backend database.

The vulnerable product is ClipBucket version 5 from MacWarrior, as referenced by the vendor name and the CPE string cpe:2.3:a:oxygenz:clipbucket. The flaw exists in all releases before 5.5.3 #80. Version 5.5.3 #80 and later contain the fix.

The CVSS score is 8.8, placing the vulnerability in the high severity range. The EPSS score is less than 1%, indicating a low current probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attack requires authentication, meaning the threat is limited to users who can log in. An attacker can exploit the flaw by sending time‑based SQL payloads that induce measurable delays, allowing the attacker to recover data byte by byte. Automated tools that support blind SQL injection could be used if the attacker has the necessary access privileges.