Skip to content
Threat Feed
Subscribe
high threat exploited

SQL Injection in CubeCart 6.7.4

An authenticated SQL injection vulnerability in CubeCart 6.7.4 allows administrative users to execute arbitrary SQL commands due to improper sanitization of the download_expire parameter.

What's new

  • 1. added detection rule: Detect CVE-2026-54644 Exploitation - XSS Attempt via Anchor Tags Aug 31, 14:05 via exploit-db
  • 2. added coverage for CubeCart (<= 6.7.4) Aug 31, 14:05 via exploit-db

CubeCart version 6.7.4 is affected by an authenticated SQL injection vulnerability, identified as CVE-2026-54647. The vulnerability exists within the administrative settings interface, specifically in the file admin/sources/settings.index.inc.php. The application fails to properly sanitize the download_expire parameter when processing POST requests to save administrative settings. Because the application uses an unsafe concatenation method to build database queries, an authenticated administrative user can inject SQL syntax by including commas and other SQL control characters in the payload. This vulnerability allows an attacker to manipulate the UPDATE SQL statements executed by the application, potentially leading to unauthorized modification of database settings or other database-level actions.

Attack Chain

  1. Attacker obtains valid administrative credentials for the target CubeCart instance.
  2. Attacker logs into the CubeCart administrative dashboard.
  3. Attacker navigates to the administrative Settings page.
  4. Attacker initiates a save request for the system settings.
  5. Attacker intercepts the HTTP POST request using a proxy tool.
  6. Attacker modifies the download_expire parameter to include malicious SQL syntax, such as "1, expire=0 WHERE 1=1-- -".
  7. The application processes the tainted input and executes the injected SQL command against the database.
  8. Unauthorized changes are applied to the database configuration or data.

Impact

Successful exploitation allows an authenticated administrative attacker to manipulate arbitrary columns within the database settings tables. This can result in unauthorized changes to system configurations or potentially facilitate lateral movement and further data compromise within the underlying database.

Recommendation

Prioritized actions for security teams:

  • Patch CubeCart to version 6.7.5 or later immediately, as this version contains the fix for CVE-2026-54647.
  • Audit administrative access logs for suspicious account activity that precedes configuration changes.
  • Review database access logs for evidence of malformed SQL queries originating from the administrative settings endpoint.
  • Disable or restrict access to the administrative dashboard to trusted internal IP addresses only.

Immediate actions

Upgrade CubeCart to version 6.7.5 or later.

IT Operations 24h

Enrichment needed

  • In-the-wild exploit activity (CTI) Monitor for real-world abuse of this CVE to prioritize response.

Mitigations

Upgrade CubeCart to 6.7.5.

immediate IT Operations

CVE-2026-54647

Gaps

  • Telemetry coverage for POST body content in webserver logs.

Detection coverage 2

Detects CVE-2026-54647 Exploitation - SQL Injection via download_expire

high

Detects potential SQL injection attempts against the CubeCart administrative settings endpoint by monitoring for SQL control characters in the download_expire parameter.

sigma tactics: execution techniques: T1059.003 sources: webserver

Detect CVE-2026-54644 Exploitation - XSS Attempt via Anchor Tags

high

Detects attempts to inject malicious JavaScript via anchor tag attributes in web application requests, indicative of CVE-2026-54644 exploitation.

sigma tactics: execution techniques: T1059.007 sources: webserver

Detection queries are available on the platform. Get full rules →