Executive brief
CubeCart is an e-commerce platform used to power online stores. The maintenance tools allow administrators to perform database operations like checking and analyzing tables. Prior to version 6.7.5, an authenticated administrator could exploit inadequate input validation to inject malicious SQL commands into these operations, potentially allowing unauthorized database modifications, data theft, or service disruption.
Technical details
The vulnerability is a SQL identifier injection in admin/sources/maintenance.index.inc.php. Administrator-controlled table names are directly interpolated into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE SQL statements without proper validation or identifier escaping. An authenticated admin can terminate a quoted table identifier with a backtick and inject arbitrary SQL structural commands. The attack requires an existing admin session (authentication is a prerequisite). An attacker with admin privileges can compromise database confidentiality, integrity, and availability within the application's database permissions. The vulnerability is fixed in version 6.7.5 by validating table names against the live database and safely escaping backticks before quoting identifiers.
Affected products
- CubeCart CubeCart before 6.7.5
Timeline
- 2026-09-17: disclosed: CVE-2026-54646 published