critical CVSS 9.8

CVE-2024-54136·PHP vulnerability

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to unserialize function. As a result, it is possible for an adversary to inject maliciously crafted PHP serialized object and utilize gadget chains to cause unexpected behaviors of the application. This vulnerability is fixed in 5.5.1 Revision 200.

Severity
critical
Software
PHP
Fixed in
5.5.1-200
Published
2024-12-06

Affected versions

From: 5.5.1-141

Until: 5.5.1-200

Fixed in: 5.5.1-200

How to fix this CVE

ClipBucket V5 versions up to 5.5.1 Revision 199 contain a PHP object deserialization flaw in the upload module that allows remote code execution through malicious serialized payloads. Immediately upgrade to ClipBucket V5.5.1 Revision 200 or later, which includes a patch that sanitizes the collection parameter before deserialization. Ensure your PHP installation is also current, as this vulnerability depends on PHP's unserialize() function processing untrusted input.

sudo dnf update php php-cli php-common -y && sudo systemctl restart httpd

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /upload/upload.php?collection=([a-zA-Z0-9+/=]+) or requests containing 'collection=' parameter with base64-encoded serialized PHP objects (pattern: O:[0-9]+:"[^"]+"|a:[0-9]+:{ when decoded)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement WAF rules to block requests to /upload/upload.php containing the 'collection' parameter with serialized object patterns (detect 'O:' or 'a:' prefix in URL-decoded values) or restrict access to /upload/upload.php to authenticated users only using IP allowlisting.

How to check if you are affected

  1. Check the installed PHP version with: php -v
  2. Verify ClipBucket version in /path/to/clipbucket/includes/config.php or check the git commit hash: git log --oneline | grep 76a829c
  3. Search access logs for requests to /upload/upload.php with serialized object patterns (base64 strings starting with 'O:' or 'a:' when decoded): grep 'upload.php.*collection=' /var/log/apache2/access.log | head -20
  4. Confirm the patch by checking if unserialize() calls in upload.php validate input before processing: grep -A 5 'unserialize' /path/to/clipbucket/upload/upload.php

FAQ

What is CVE-2024-54136?

CVE-2024-54136 is a critical PHP object deserialization vulnerability in ClipBucket V5 that allows unauthenticated attackers to execute arbitrary code by sending crafted serialized objects through the collection parameter in the upload module.

Is CVE-2024-54136 being actively exploited?

No, according to CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability is not currently being actively exploited in the wild, though public exploit code is not yet available.

What versions of PHP are affected by CVE-2024-54136?

ClipBucket V5 versions 5.5.1 Revision 141 through 5.5.1 Revision 199 are vulnerable. The vulnerability depends on PHP's default deserialization behavior, affecting any installation using these ClipBucket revisions with PHP 7.x or 8.x.

How do I check if my server is vulnerable to CVE-2024-54136?

Run: php -v to confirm PHP is installed, then check your ClipBucket version in /includes/config.php or via git: git log --oneline | grep -i revision | head -1. If the revision number is 199 or below, you are vulnerable.

Does Defensia detect CVE-2024-54136?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHP is installed on a monitored server, CVE-2024-54136 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2026-39337CVSS 10ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-46348CVSS 10YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-54136. Free for 1 server.

Get started free