7.2

CVE-2025-62429

Exploit

ClipBucket v5 executes arbitrary PHP code

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbitrary PHP code execution. In /upload/admin_area/actions/update_launch.php, the "type" parameter from a POST request is embedded into PHP tags and executed. Proper sanitization is not performed, and by injecting malicious code an attacker can execute arbitrary PHP code. This allows an attacker to achieve RCE. This issue has been resolved in version 5.5.2 #147.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oxygenz ≫ Clipbucket Version >= 5.3 < 5.5.2-147
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.78% 0.51
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://github.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-3x4g-x3gv-rjmq
Vendor Advisory
Exploit
https://github.com/MacWarrior/clipbucket-v5/commit/e81bac602c871bb1ad971884003a3a496a2ab50b
Patch
https://github.com/MacWarrior/clipbucket-v5/releases/tag/5.5.2-%23147
Release Notes