CVE-2026-54642: CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens. This issue is fixed in version 6.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CubeCartto a version that resolves this vulnerability.Fixed in 6.7.5
Event History
Frequently Asked Questions
Which deployments are affected?
CubeCart versions prior to 6.7.5 are affected. The vulnerable actions are in the administrative orders interface, so exploitation requires an authenticated administrator.
What does an attacker need to exploit this issue?
An attacker must induce an authenticated administrator to send a request to the affected administrative endpoint. The affected reset_id and delete_card actions use state-changing GET requests and do not require a validated session token.
What could happen if exploitation succeeds?
An attacker can cause electronic download usage counters to be reset or stored customer payment-card tokens to be deleted. The described impact is unintended administrative actions rather than access to card details.
What should be done if patching cannot happen immediately?
The provided information identifies the affected actions as reset_id and delete_card in the administrative orders interface, but does not specify a supported workaround. Prioritize restricting administrator access and avoiding untrusted links or requests while planning an upgrade to 6.7.5.