CVE-2026-39358
HighSummary
In CubeCart prior to version 6.6.0, authenticated time-based blind SQL injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database.
Risk Assessment
This vulnerability could lead to serious data security breaches, including unauthorized access to sensitive information in the database.
Recommendation
It is recommended to upgrade CubeCart to version 6.6.0 or later to mitigate this vulnerability.
Other vulnerabilities in CubeCart v6.x
See all- CVE-2026-45708High
CubeCart is an ecommerce software solution that prior to version 6.7.3 allowed admins with document edit permissions to save raw PHP code in the Invoice Editor. When any admin clicks Print, the rendered template is saved in a file that can be executed by unauthenticated users.
- CVE-2026-45055High
CubeCart prior to version 6.7.2 has a vulnerability that allows an attacker to take over a user account by manipulating links in emails. An attacker can exploit the Host header to send a malicious link to the victim, leading to account takeover.
- CVE-2026-45714Critical
CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input, allowing authenticated users with administrative privileges to execute arbitrary operating system commands.
- CVE-2026-45053Critical
CubeCart prior to version 6.7.0 contained an Authenticated Arbitrary File Upload vulnerability in the REST API File Manager endpoint. This allows any holder of an API key with files:rw permission to upload PHP files to the images/source/ directory, where they are executed by the web server.
- CVE-2026-44377Critical
CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates and Documents. The application unsafely evaluates user-supplied input through the Smarty template engine.
Original NVD description (English source)
CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.