ClipBucket v5 versions prior to 5.5.3-#182 contain a blind SQL injection flaw in the photo search endpoint. The vulnerability arises because query parameters are passed unsanitized into both the WHERE and ORDER BY clauses of a database query. An unauthenticated attacker can craft requests that cause time‑based blind SQL injection, allowing the attacker to extract sensitive data such as user credentials, email addresses, and administrator password hashes. Once these credentials are known, the attacker can compromise accounts and take over the system, directly affecting confidentiality and integrity.

The affected product is ClipBucket v5 provided by MacWarrior, specifically all releases before version 5.5.3-#182. The vulnerability is present in the photo search feature and does not require explicit authentication to exploit.

The CVSS score of 8.7 indicates a high severity vulnerability, and the lack of authentication requirements means the attack can be launched from any network location. Although no EPSS score is published, the generic nature of the blind SQL injection and the absence of mitigations in the affected code suggest a high likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the potential for credential theft and account takeover warrants immediate attention. The most probable attack path is through unauthenticated HTTP requests to the search_result.php endpoint, where the attacker can progressively probe database responses via timing attacks.