CVE-2026-54646: CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CubeCartto a version that resolves this vulnerability.Fixed in 6.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated CubeCart administrator. The attacker must be able to supply a crafted table-name value to the affected maintenance functionality.
Which deployments are affected?
CubeCart versions before 6.7.5 are affected. The vulnerable code is in admin/sources/maintenance.index.inc.php, so exposure depends on administrative access to the maintenance functionality.
What can an attacker do through successful exploitation?
An administrator can use an embedded backtick to break out of the quoted identifier and introduce structural SQL into ALTER TABLE, CHECK TABLE, or ANALYZE TABLE statements. The resulting impact can include compromise of confidentiality, integrity, and availability within the application's database privileges.
How should this be remediated?
Upgrade CubeCart to version 6.7.5, which fixes the issue. If upgrading cannot happen immediately, restrict and review administrator access because authenticated administrator privileges are required for exploitation.