Executive brief
CubeCart is an e-commerce platform used by businesses to manage online stores. A security flaw in the administrative dashboard allows staff members with basic order-viewing permissions to perform unauthorized database queries. This could lead to the theft of sensitive information, including customer personal data, administrator password hashes, and payment gateway credentials.
Technical details
An authenticated SQL injection vulnerability exists in CubeCart's admin orders-transactions listing page (admin.php?_g=orders&node=transactions). The application constructs a raw SQL 'ORDER BY' fragment using the $_GET['sort'] array without validating column names or sort directions. While the framework uses sqlSafe() (mysqli::real_escape_string), this only escapes quotes and other characters not required for injection within an ORDER BY clause. An attacker with at least CC_PERM_READ permissions can use time-based blind extraction to retrieve sensitive data from the database, such as PII and credentials. The issue is resolved in version 6.7.0.
Affected products
- CubeCart CubeCart < 6.7.0
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD