CVE-2026-54647: CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled downloadexpire POST parameter into a raw UPDATE statement for CubeCartdownloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CubeCartto a version that resolves this vulnerability.Fixed in 6.7.5
Event History
Frequently Asked Questions
Which deployments are affected?
CubeCart versions earlier than 6.7.5 are affected. Version 6.7.5 includes the fix.
What access does an attacker need?
Exploitation requires authenticated administrator access and the ability to submit the download_expire POST parameter. The issue is not described as exploitable by unauthenticated users.
What could successful exploitation allow?
An administrator can use a comma-delimited value to alter the SQL UPDATE SET clause. This can manipulate database columns and potentially other data available through the application's database privileges.
How can I check whether action is needed?
Identify the deployed CubeCart version. Installations running a version prior to 6.7.5 should be treated as affected and upgraded to 6.7.5.