The vulnerability exists in ClipBucket version 5, where unauthenticated but authenticated admin users can manipulate the 'type' GET parameter on the admin_area/action_logs.php endpoint. The input is concatenated directly into a SQL WHERE clause without parameterization, enabling UNION-based SQL injection. This allows an attacker with administrative credentials to exfiltrate arbitrary data from the database, compromising confidentiality and potentially integrity of stored information.

ClipBucket, version 5.x before 5.5.3. The bug is present in all builds prior to the 5.5.3 release that fixed the issue. Administrators using the outdated platform should verify their installation version and apply updates accordingly.

The CVSS score of 7.1 indicates a high severity. No EPSS score is available, so precise exploitation probability cannot be quantified, but the vulnerability is not listed in CISA KEV. The likely attack vector requires authenticated access to the admin interface; an attacker who gains or impersonates an administrator can directly inject malicious SQL through the vulnerable parameter.