Listen to this Post
The vulnerability is a stored Cross-Site Scripting (XSS) flaw in the `Playlist Name` field. When an authenticated user creates a playlist, input is not properly sanitized. Malicious HTML or JavaScript code, such as <img src=x onerror=alert('OMG')>, is saved in the playlist name. This code is then rendered unescaped on playlist detail and listing pages. Whenever any user, including administrators, views these pages, the embedded script automatically executes in their browser. This allows an attacker to perform actions within the security context of the victim’s session.
Platform: ClipBucket v5
Version: <= 5.5.2
Vulnerability: Stored XSS
Severity: Critical
date: 2025-12-11
Prediction: 2025-12-18
What Undercode Say:
Bash commands and codes related to the blog
Example payload for Playlist Name field
<img src=x onerror=alert('OMG')>
Example payload for Photo field
"><img src=x onerror=alert('XSS')>
How Exploit:
1. Attacker logs in as a regular user.
- Creates a playlist with a malicious name containing JavaScript.
- The malicious code executes when an admin views the playlist page.
Protection from this CVE:
- Update to patched version >= 5.5.2 – 157.
- Implement strict input sanitization for all user-facing fields.
- Encode output to prevent browser execution.
Impact:
- Arbitrary JavaScript execution in victim’s browser.
- Session hijacking and privilege escalation.
- Full administrator account compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
