CVE-2025-55911

MEDIUM

ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-55911 has a selected CVSS score of 6.5 (medium); EIP currently links 1 catalogued exploit.

Description

An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 18, 2025 · Source: CVE List

Proofs of concept

1

Catalogued exploits

ExploitDBClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)ExploitDB exploitby Mukundsinh Solanki (r00td3str0y3r)Scanner1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact describes an SSRF vulnerability in ClipBucket 5.5.2 and provides a single HTTP POST request as a PoC. The request sends a URL to the server, which will attempt to connect to the specified internal service, demonstrating the vulnerability. No code is provided to exploit the SSRF for further impact such as data exfiltration or internal pivoting; the request only triggers the server-side request to prove the vulnerability exists.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a plaintext description of an SSRF vulnerability in ClipBucket, including a single HTTP POST request as a proof-of-concept. The request uses a standard `file` parameter to target an internal service (127.0.0.1:3306). No backdoor, deceptive payload, or concealed executable behavior is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagestext
Target softwareClipBucket
Attack typesSSRF
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact provides a single HTTP request that triggers a server-side request to a user-supplied URL, demonstrating the existence of the SSRF vulnerability. It does not include code to exploit the SSRF for further impact such as data exfiltration, internal pivoting, or command execution. The request itself only validates the vulnerability by causing the server to connect to an internal service, which is characteristic of a scanner/proof-of-concept rather than a full exploit.

exploits/multiple/remote/52434.txt:19-32

Requirements

  • An authenticated user session with regular permissions is required.exploits/multiple/remote/52434.txt:12
  • The target must be running ClipBucket 5.5.2 Build #90.exploits/multiple/remote/52434.txt:1

Observed behavior

  • Sends an HTTP POST request to /upload/actions/file_downloader.php with a file parameter containing a URL pointing to an internal service (127.0.0.1:3306).exploits/multiple/remote/52434.txt:21-26
  • The server attempts to connect to the internal service specified in the file parameter, demonstrating the SSRF vulnerability.exploits/multiple/remote/52434.txt:31-32
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldThe PoC demonstrates SSRF by directing the server to make a request to an internal MySQL port, which is the stated vulnerability behavior.exploits/multiple/remote/52434.txt:26
Review boundaries

What the analysis did not establish

  • The artifact is a text writeup with a single HTTP request; no executable exploit code is provided.
  • The described impact (internal network enumeration, data exfiltration, pivoting) is not demonstrated by the supplied PoC request.
  • The CVE description mentions 'execute arbitrary codes' but the artifact only describes and demonstrates SSRF; no code execution mechanism is shown.
  • Only the supplied text file was reviewed; no external tools, libraries, or referenced resources were inspected.
  • The artifact is a plaintext description and PoC request; no executable code or binary content was present to analyze.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2