CVE-2026-21875

When adding a comment to a channel, the application sends a POST request to the /actions/ajax.php endpoint. The obj_id parameter from this request is passed directly to the user_exists function in the upload/includes/classes/user.class.php file as the $id variable, and then to the count function in the upload/includes/classes/db.class.php file. The $id parameter is concatenated directly into the SQL query without any input validation or sanitization. An attacker can provide a payload like '1' or 1=1-- -', which triggers blind SQL injection, allowing data to be read from the database by analyzing application behavior.

An unauthenticated remote attacker can gain unauthorized access to database contents, including user data, passwords and other sensitive information, and potentially also modify or delete application data.

At the time of publication, the vulnerability had no available patch. You should monitor the project repository at https://github.com/MacWarrior/clipbucket-v5 and apply the patch immediately upon release. Until a patch is released, it is recommended to restrict access to the /actions/ajax.php endpoint (e.g., through a WAF application firewall) and consider temporarily disabling the channel commenting feature.

ClipBucket v5 in versions 5.5.2-#187 and lower (open source video sharing platform).