# CVE-2026-54646: CubeCart SQL identifier injection in maintenance tools

Source: https://junglewise.ai/threats/cve-2026-54646-cubecart-sql-identifier-injection-in-maintenance-tools  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54646 · Severity: high · CVSS 7.2 · Published 2026-09-17

CubeCart is an e-commerce platform used to power online stores. The maintenance tools allow administrators to perform database operations like checking and analyzing tables. Prior to version 6.7.5, an authenticated administrator could exploit inadequate input validation to inject malicious SQL commands into these operations, potentially allowing unauthorized database modifications, data theft, or service disruption.

Technologies: [CubeCart](https://junglewise.ai/threats/technologies/cubecart). Vendors: [CubeCart](https://junglewise.ai/threats/vendors/cubecart).

## Quick answers

**Is CVE-2026-54646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54646 being exploited in the wild.

**How severe is CVE-2026-54646?** High severity, with a CVSS score of 7.2, published 17 September 2026.

**Which products and versions are affected?** CubeCart before 6.7.5.

**Is there a fix for CVE-2026-54646?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54646 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54646?** Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL identifier injection in admin/sources/maintenance.index.inc.php. Administrator-controlled table names are directly interpolated into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE SQL statements without proper validation or identifier escaping. An authenticated admin can terminate a quoted table identifier with a backtick and inject arbitrary SQL structural commands. The attack requires an existing admin session (authentication is a prerequisite). An attacker with admin privileges can compromise database confidentiality, integrity, and availability within the application's database permissions. The vulnerability is fixed in version 6.7.5 by validating table names against the live database and safely escaping backticks before quoting identifiers.

## Affected products

- CubeCart CubeCart before 6.7.5

## Timeline

- 2026-09-17: disclosed: CVE-2026-54646 published

## References

- [https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php](https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php)
- [https://github.com/cubecart/v6/commit/fc08d55628191969f2345d06d862df316f7d44d3](https://github.com/cubecart/v6/commit/fc08d55628191969f2345d06d862df316f7d44d3)

## Related threats

- [CubeCart broken access control in GDPR customer purge](https://junglewise.ai/threats/cve-2026-54648-cubecart-broken-access-control-in-gdpr-customer-purge)
- [CubeCart SQL injection in download_expire settings parameter](https://junglewise.ai/threats/cve-2026-54647-cubecart-sql-injection-in-download-expire-settings-parameter)
- [CubeCart stored XSS in product description fields](https://junglewise.ai/threats/cve-2026-54645-cubecart-stored-xss-in-product-description-fields)
- [CubeCart XSS in GUI messages via unsafe anchor attributes](https://junglewise.ai/threats/cve-2026-54644-cubecart-xss-in-gui-messages-via-unsafe-anchor-attributes)
- [CubeCart missing delete permission check in order notes handler](https://junglewise.ai/threats/cve-2026-54643-cubecart-missing-delete-permission-check-in-order-notes-handler)