CVE-2026-54647

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
https://github.com/cubecart/v6/commit/af7def4d279f7cefb23c1009a987737c16a105da
https://github.com/cubecart/v6/releases/tag/6.7.5
https://github.com/cubecart/v6/security/advisories/GHSA-hvmw-v8gc-4c29

Configurations

No configuration.

History

17 Sep 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 22:17

Updated : 2026-09-24 21:17

NVD link : CVE-2026-54647

Mitre link : CVE-2026-54647

CVE.ORG link : CVE-2026-54647

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-54647", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54647", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-24T20:48:55.165253Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cubecart", "product": "v6", "versions": [{"status": "affected", "version": "< 6.7.5"}]}]}], "published": "2026-09-17T22:17:02.703", "references": [{"url": "https://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php", "source": "security-advisories@github.com"}, {"url": "https://github.com/cubecart/v6/commit/af7def4d279f7cefb23c1009a987737c16a105da", "source": "security-advisories@github.com"}, {"url": "https://github.com/cubecart/v6/releases/tag/6.7.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/cubecart/v6/security/advisories/GHSA-hvmw-v8gc-4c29", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5."}], "lastModified": "2026-09-24T21:17:16.987", "sourceIdentifier": "security-advisories@github.com"}