critical CVSS 9.8

CVE-2024-54135·PHP vulnerability

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php within the decode_key function. User inputs were supplied to this function without sanitization via collection GET parameter and photoIDS POST parameter respectively. The decode_key function invokes PHP unserialize function as defined in upload/includes/classes/photos.class.php. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200.

Severity
critical
Software
PHP
Fixed in
5.5.1-200
Published
2024-12-06

Affected versions

From: 2.0

Until: 5.5.1-200

Fixed in: 5.5.1-200

How to fix this CVE

ClipBucket V5 running versions 2.0 through 5.5.1-199 contain a critical PHP object deserialization flaw that allows unauthenticated attackers to execute arbitrary code through malicious serialized payloads. Immediately upgrade to ClipBucket V5.5.1-200 or later, which patches the unsafe unserialize() calls in the photo upload handler. Verify the fix by confirming your installation revision matches 200 or higher.

sudo dnf update php

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /upload/photo_upload.php HTTP/1.1
.*photoIDS=.*O:[0-9]+:.*|.*collection=.*a:[0-9]+:.*

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block or strictly validate POST requests to /upload/photo_upload.php where photoIDS or collection parameters contain PHP serialization markers (strings starting with 'O:', 'a:', 's:', 'i:', etc.). Implement input whitelisting to reject any non-alphanumeric values in these parameters.

How to check if you are affected

  1. Step 1: Check ClipBucket installation version with: grep -r "VERSION" /path/to/clipbucket/includes/config.php | head -1
  2. Step 2: Verify the revision number from the admin dashboard or installation directory: cat /path/to/clipbucket/VERSION.txt or check database schema version
  3. Step 3: Search web server access logs for POST requests to /upload/photo_upload.php with serialized PHP objects (look for patterns like 'O:' or 'a:' in photoIDS parameter): grep -i "photo_upload.php" /var/log/apache2/access.log | grep -E "(photoIDS|collection)"
  4. Step 4: After patching, confirm the decode_key function no longer calls unserialize() directly: grep -n "unserialize" /path/to/clipbucket/upload/includes/classes/photos.class.php

FAQ

What is CVE-2024-54135?

CVE-2024-54135 is a critical PHP object deserialization vulnerability in ClipBucket V5 that permits remote code execution when attackers submit maliciously crafted serialized objects to the photo upload endpoint, exploiting unsafe unserialize() usage without input validation.

Is CVE-2024-54135 being actively exploited?

According to CISA's Known Exploited Vulnerabilities catalog, CVE-2024-54135 is not currently listed as actively exploited in the wild, but it should still be treated as critical due to its CVSS 9.8 score and ease of exploitation.

What versions of PHP are affected by CVE-2024-54135?

ClipBucket V5 versions 2.0 through 5.5.1 Revision 199 are vulnerable. The vulnerability was patched in revision 200 of version 5.5.1. Any installation reporting a revision number below 200 is at risk.

How do I check if my server is vulnerable to CVE-2024-54135?

Run: grep -r "Revision" /path/to/clipbucket/includes/config.php && cat /path/to/clipbucket/VERSION.txt to determine your installed version and revision. If the revision is 199 or lower, your server is vulnerable.

Does Defensia detect CVE-2024-54135?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If ClipBucket V5 is installed on a monitored server, CVE-2024-54135 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-54135. Free for 1 server.

Get started free