Executive brief
CubeCart is an e-commerce platform used to run online stores. The system's error and warning messages were not properly filtering malicious content in links, allowing attackers to inject JavaScript code that executes when administrators view those messages. This could lead to session hijacking, unauthorized store actions, or data theft within an admin's browser session.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the _errorMessage method of classes/gui.class.php. The code uses strip_tags() to permit anchor elements in error, information, and warning messages, but this approach preserves unsafe href attributes (including javascript: URIs) and onclick event handlers. Attacker-controlled input from search parameters or form fields can reach GUI messages and pass through the filter. When an authenticated administrator views the rendered anchor and clicks it or the page loads, the injected JavaScript executes in their browser session with full administrative privileges. The vulnerability requires an attacker to inject malicious data into searchable or logged fields that are later displayed in system messages. The fix, released in version 6.7.5, rebuilds anchor elements with only a scheme-validated href attribute, stripping all other unsafe attributes.
Affected products
- CubeCart CubeCart prior to 6.7.5
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fixed in version 6.7.5