SQL Injection Vulnerability in CubeCart E-commerce Software

CVE-2026-45054

What is CVE-2026-45054?

CubeCart, an e-commerce software solution, has a vulnerability in its admin orders-transactions listing page that can allow an attacker to exploit SQL injection. The issue arises from the application's unsafe construction of an ORDER BY clause using unvalidated parameters from the attacker-controlled $_GET['sort'] array. An authenticated administrator with basic permissions can manipulate these parameters, leading to the execution of arbitrary SQL commands on the store's database. This can potentially expose sensitive information such as administrator password hashes, customer personal identifiable information (PII), and payment gateway credentials. This vulnerability has been addressed in version 6.7.0.

References