rootpwn

high · CVSS v3 7.2

CVE-2026-54647

CubeCart e‑commerce software is vulnerable to SQL injection via the admin download_expire parameter. An authenticated administrator can mani

Overview

CubeCart e‑commerce software is vulnerable to SQL injection via the admin download_expire parameter. An authenticated administrator can manipulate database columns by supplying a comma‑delimited value. The flaw is fixed in version 6.7.5.

Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.

Impact

Confidentiality: attackers can read sensitive data. Integrity: database columns can be altered, compromising product listings and orders. Availability: malicious updates could disrupt site operations. The primary impact is on site administrators and the customers whose data may be exposed.

Remediation

Upgrade CubeCart to version 6.7.5 or later. If an upgrade is not immediately possible, restrict administrator access to the settings page and implement server‑side validation to ensure download_expire is numeric. Monitor database logs for unexpected UPDATE statements and apply any vendor patches as soon as they are released.

Risk context

The vulnerability is rated high with a CVSS v3 score of 7.2. No EPSS data is available, but the lack of input validation poses a significant risk to any CubeCart installation running a vulnerable version.

Affected products

  • CubeCart 6.7.4
  • CubeCart 6.7.3
  • CubeCart 6.7.2
  • CubeCart 6.7.1
  • CubeCart 6.7.0
  • CubeCart 6.6.x
  • CubeCart 6.5.x
  • CubeCart 6.4.x

Scores

Severity
high
CVSS v2
8.3
CVSS v3
7.2
CVSS v4
—
EPSS
—

sql-injection ecommerce admin CubeCart database high-severity patch input-validation

← All CVEs

Related CVEs

high

CVE-2026-83946

CVE-2026-83946 is a cross-site scripting vulnerability in Microsoft Azure Portal caused by insufficient input neutralization during web page generation. It can allow an unauthorized attacker to spoof portal content over a network. It matters because Azure Portal is a privileged management interface for cloud resources.

View analysis

high

CVE-2026-85887

CVE-2026-85887 is a high-severity permission misconfiguration in Microsoft 365 Copilot. It can allow an authorized attacker to disclose information over a network. It matters because it may expose sensitive tenant or user data if Copilot resources are over-permissioned.

View analysis

high

CVE-2026-93450

The go-openapi/swag jsonutils library (v0.27.0 and earlier) has a stack‑overflow flaw when parsing deeply nested JSON. Attackers can send malformed OpenAPI specs to any service that uses this library, causing the process to crash and all current requests to fail.

View analysis

high

CVE-2026-93452

snappy-java 1.1.10.8 has a buffer overflow in Snappy.compress(ByteBuffer, ByteBuffer) that can corrupt off‑heap memory and crash the JVM. The flaw is triggered by incompressible data that exceeds the destination buffer’s remaining capacity. It can cause application downtime in any Java process using the affected library.

View analysis