CVE-2026-45054: CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing

CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?g=orders&node=transactions) builds a raw ORDER BY SQL fragment from the attacker-controlled $GET['sort'] array without column or direction validation. Both the column key and the direction value flow into the query string as bare SQL tokens, and the framework's sqlSafe() (mysqli escapestring) escapes only quote characters — none of which are required for ORDER BY injection. An authenticated administrator with the minimum CCPERMREAD permission on orders can execute arbitrary SQL against the store database, including time-based blind extraction of admin password hashes, customer PII, and integrated payment-gateway credentials. This vulnerability is fixed in 6.7.0.