ClipBucket v5: SQL injection via ads manager delete parameter

Summary

ClipBucket v5 through 5.5.3-#197 contains an SQL injection flaw in the delete parameter of admin_area/ads_manager.php. An authenticated user with the ad_manager_access permission can inject SQL into the AdsManager::DeleteAd query. Using time-based blind payloads, an attacker can extract user credentials and email addresses or modify and delete arbitrary database records.

Affected

• ClipBucket v5 (MacWarrior clipbucket-v5) from 0 up to and including 5.5.3-#197
• Vulnerable code: upload/includes/classes/ads.class.php (lines 102-110 at commit f15cef1a2431786c31ffd79e81f55d6eeca4ebc0)

Fixed in

Unknown. PR #925 contains a patch commit, but its merge status and inclusion in a release are not confirmed.

Workaround

• No vendor-tested workaround confirmed.
• One source suggests generic WAF rules for SQL injection patterns; this is not vendor-tested.
• Restrict access to /admin_area/ to VPN or internal networks.
• Remove ad_manager_access from accounts that do not need it.

Exploitation

• CISA SSVC: exploitation status "poc", not automatable.
• Not listed in the CISA KEV catalog; no in-the-wild exploitation reported in the consulted sources.
• A public write-up with demonstration requests exists. Sources disagree on whether public exploit code is available; assume a public PoC is likely.
• Authentication with an admin-area account holding ad_manager_access is required.

Our recommendation

• Inventory all ClipBucket v5 instances and record their build numbers.
• Restrict the admin area by IP address or VPN and review who holds ad_manager_access.
• Run the database account with least privilege.
• Review web logs for slow or repeated requests to admin_area/ads_manager.php with a delete parameter.
• Audit the ads and user tables for unexpected changes; rotate admin credentials if you find any.
• Watch PR #925 and the GitHub releases page and update once a fixed release is confirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory: ClipBucket v5 SQL injection via ads_manager.php delete parameter www.vulncheck.com
• ClipBucket v5 GitHub repository github.com
• Vulnerable code in ads.class.php at commit f15cef1 github.com
• ClipBucket v5 pull request #925 github.com
• HackMD write-up: SQL injection via delete ads in ClipBucket v5 hackmd.io
• OSV entry for CVE-2026-103766 osv.dev
• ClipBucket v5 releases github.com
• TheHackerWire: CVE-2026-103766 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:27.