Executive brief
CubeCart is an e-commerce platform that manages online stores, product catalogs, and customer payments. Prior to version 6.7.5, two administrative functions—resetting electronic download usage counters and deleting stored payment card tokens—lacked proper request forgery protection. An attacker could trick an authenticated store administrator into performing these actions unknowingly, resulting in loss of customer payment data or disruption of digital product delivery.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in CubeCart's admin interface. Two state-changing actions—reset_id (download-counter reset) and delete_card (stored-payment-card deletion)—were implemented as GET requests without CSRF token validation. These actions were omitted from the CSRF protection map in admin/skins/default/csrf.inc.php and vulnerable code was in admin/sources/orders.index.inc.php. An attacker can craft a malicious webpage containing an image tag or link that, when visited by an authenticated admin, triggers the request without a validated session token. The attack requires an active admin session but no additional authentication or user interaction beyond clicking a link or visiting a page. The fix, released in version 6.7.5, adds CSRF protection by validating session tokens and updating the CSRF map to include these actions.
Affected products
- CubeCart CubeCart before 6.7.5
Timeline
- 2026-09-17: disclosed: CVE-2026-54642 published
- 2026-09-17: patched: Fixed in CubeCart 6.7.5