CubeCart 6.7.4 - Cross-Site Scripting

Indicators of Compromise

• exploit-code: # Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php # Date: 2026-06-08 # Exploit Author: Mikail Kocadağ (MKLKCDG) # Vendor Homepage: https://www.cubecart.com/ # Software Link: https://github.com/cubecart/v6 # Vulnerable Version: 6.7.4 # Fixed Version: 6.7.5 # CVE: CVE-2026-54644 # Advisory / References: https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq -------------------------------------------------------------------------------- VULNERABILITY SUMMARY -------------------------------------------------------------------------------- The GUI message rendering component in CubeCart 6.7.4 suffers from a Cross-Site Scripting (XSS) vulnerability due to an insecure `strip_tags` allowlist configuration that permits harmful attributes inside anchor elements. In `classes/gui.class.php` (lines 1794-1802), system messages (error, info, warning) are filtered using `strip_tags($message, '<a>')`. While this strips other HTML tags, it allows the `<a>` tag to retain all attributes without sanitization. -------------------------------------------------------------------------------- IMPACT -------------------------------------------------------------------------------- An attacker passing inputs through search parameters or input fields that reflect into GUI message components can inject `javascript:` URIs or inline event handlers (e.g., `onclick`) inside the anchor tag. When rendered in the context of a user's or administrator's browser session, this allows arbitrary JavaScript execution, potentially leading to session hijacking or unauthorized administrative actions. -------------------------------------------------------------------------------- PROOF OF CONCEPT (PoC) -------------------------------------------------------------------------------- 1. Trigger a system message wrapper via a search query or input parameter. 2. Inject an anchor tag payload containing a `javascript:` scheme: <a href="javascript:alert(1)">Click Here</a> 3. When the user or administrator views or interacts with the rendered system alert block, the embedded JavaScript payload executes.