CVE-2026-54646

Overview

A SQL injection vulnerability exists in CubeCart prior to version 6.7.5 within the administrative maintenance script. The application fails to properly sanitize or escape table identifier parameters before concatenating them into structural database management queries. This allows an authenticated administrator to inject arbitrary SQL statements, threatening the underlying database environment.

Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.

Impact

Successful exploitation compromises database confidentiality, integrity, and availability within the scope of the application's database privileges. An attacker with administrative access could read, modify, or delete sensitive business and customer information or disrupt store operations. The impact is limited to environments where administrative access is already possessed or has been compromised.

Remediation

Upgrade CubeCart to version 6.7.5 or later to apply the official fix for identifier validation. As a defense-in-depth measure, restrict access to the administrative interface using network controls or IP allowlisting, and ensure the database user operates under the principle of least privilege.

Risk context

The vulnerability carries a High severity rating with a CVSS v3 score of 7.2. Although the requirement for administrative privileges reduces the likelihood of unauthenticated exploitation, immediate patching is recommended to protect against insider threats or session hijacking.

Affected products

• CubeCart CubeCart < 6.7.5