MacWarrior clipbucket-v5 up to 5.5.1 Revision 199 upload/photo_upload.php decode_key deserialization

Summaryinfo

A vulnerability categorized as very critical has been discovered in MacWarrior clipbucket-v5 up to 5.5.1 Revision 199. Affected is the function decode_key of the file upload/photo_upload.php. Executing a manipulation can lead to deserialization. This vulnerability is handled as CVE-2024-54135. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in MacWarrior clipbucket-v5 up to 5.5.1 Revision 199 and classified as very critical. This vulnerability affects the function decode_key of the file upload/photo_upload.php. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php within the decode_key function. User inputs were supplied to this function without sanitization via collection GET parameter and photoIDS POST parameter respectively. The decode_key function invokes PHP unserialize function as defined in upload/includes/classes/photos.class.php. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-54135 since 11/29/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/22/2025).

By approaching the search of inurl:upload/photo_upload.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.5.1 Revision 200 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• MacWarrior

Name

• clipbucket-v5

Version

• 5.5.1 Revision 199

Website

• Product: https://github.com/MacWarrior/clipbucket-v5/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion