CubeCart vulnerabilities

CubeCart is an ecommerce software solution that prior to version 6.7.3 allowed admins with document edit permissions to save raw PHP code in the Invoice Editor. When any admin clicks Print, the rendered template is saved in a file that can be executed by unauthenticated users.

CubeCart prior to version 6.7.2 has a vulnerability that allows an attacker to take over a user account by manipulating links in emails. An attacker can exploit the Host header to send a malicious link to the victim, leading to account takeover.

In CubeCart prior to version 6.6.0, authenticated time-based blind SQL injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database.

CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates, Invoices, Documents, and Contact Forms. The application unsafely evaluates user-supplied input, allowing authenticated users with administrative privileges to execute arbitrary operating system commands.

CubeCart prior to version 6.7.0 contained an Authenticated Arbitrary File Upload vulnerability in the REST API File Manager endpoint. This allows any holder of an API key with files:rw permission to upload PHP files to the images/source/ directory, where they are executed by the web server.

CubeCart prior to version 6.7.0 has an Authenticated Server-Side Template Injection (SSTI) vulnerability in multiple modules, including Email Templates and Documents. The application unsafely evaluates user-supplied input through the Smarty template engine.