CVE-2025-55912

HIGH

ClipBucket 5.5.0 - Arbitrary File Upload

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-55912 has a selected CVSS score of 7.3 (high); EIP currently links 1 catalogued exploit.

Description

An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 18, 2025 · Source: CVE List

Proofs of concept

1

Catalogued exploits

ExploitDBClipBucket 5.5.0 - Arbitrary File UploadExploitDB exploitby Mukundsinh Solanki (r00td3str0y3r)Exploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a complete HTTP POST request with a multipart form body containing a PHP webshell (`payload withheld`) and the resulting URL to trigger remote code execution. It is a ready-to-use exploit payload.

Backdoor review

No backdoor observed in reviewed code

The PoC is a plaintext description of an unauthenticated file upload vulnerability in ClipBucket 5.5.0. It includes a sample HTTP request that uploads a simple PHP webshell and a URL to access it. The payload is a standard, minimal webshell (`payload withheld`) that is fully disclosed and directly related to the stated exploit. No concealed, deceptive, or unrelated harmful behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesHTTPPHP
Target softwareClipBucket
Attack typesArbitrary File UploadRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, ready-to-use HTTP request that uploads a PHP webshell and the URL to access it for command execution. This is code intended to exercise a vulnerability, not merely detect it.

exploits/multiple/remote/52435.txt:28-37exploits/multiple/remote/52435.txt:40-44

Requirements

  • Target must be running ClipBucket version 5.5.0 or earlier with the vulnerable photo_uploader.php endpoint exposed.exploits/multiple/remote/52435.txt:20-24

Observed behavior

  • Sends an unauthenticated multipart POST request to /upload/actions/photo_uploader.php containing a file named shell.php with PHP code.exploits/multiple/remote/52435.txt:28-37
  • The uploaded PHP file executes system commands passed via the 'cmd' URL parameter when accessed at /files/photos/shell.php.exploits/multiple/remote/52435.txt:36exploits/multiple/remote/52435.txt:40-44
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell
Payload withheldThe PoC demonstrates the vulnerability by uploading a simple, explicit PHP webshell. The payload is directly related to the described exploit and is not concealed.exploits/multiple/remote/52435.txt:36
Url
Payload withheldThe PoC provides an example URL to access the uploaded webshell, consistent with the described exploit behavior.exploits/multiple/remote/52435.txt:44
Review boundaries

What the analysis did not establish

  • The artifact is a text file containing a PoC request; no executable code was run.
  • The exact upload path (/files/photos/) is assumed but not verified against the target application's configuration.
  • The artifact does not include a scanner or detection logic; it is purely an exploitation payload.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5