CubeCart 6.7.4 - SQL

Indicators of Compromise

• exploit-code: # Exploit Title: CubeCart 6.7.4 - SQL Bypass in maintenance.index.inc.php # Date: 2026-06-08 # Exploit Author: Mikail Kocadağ # Vendor Homepage: https://www.cubecart.com/ # Software Link: https://github.com/cubecart/v6 # Vulnerable Version: 6.7.4 # Fixed Version: 6.7.5 # CVE: CVE-2026-54646 # Advisory / References: https://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx -------------------------------------------------------------------------------- VULNERABILITY SUMMARY -------------------------------------------------------------------------------- An authenticated administrative SQL injection vulnerability via identifier injection exists in the maintenance component of CubeCart 6.7.4. In `admin/sources/maintenance.index.inc.php` at line 551, user-supplied table names from POST parameters are wrapped in backticks (`) and passed directly into structural SQL statements like `ALTER TABLE`, `CHECK TABLE`, or `ANALYZE TABLE`. Because the global `htmlspecialchars` sanitizer does not alter backticks, an attacker can supply a closing backtick followed by SQL commands to perform arbitrary database operations. -------------------------------------------------------------------------------- IMPACT -------------------------------------------------------------------------------- An authenticated administrator can break out of the table identifier enclosure and execute arbitrary SQL statements. This can result in complete compromise of the database structure and data depending on the database user's privileges. -------------------------------------------------------------------------------- PROOF OF CONCEPT (PoC) -------------------------------------------------------------------------------- 1. Log into the administration panel with database maintenance capabilities. 2. Navigate to Database Maintenance toolkit. 3. Select a database table action and inject a closing backtick within the table name POST parameter: mytable`; [MALICIOUS_SQL]-- - 4. Submit the request to observe the execution of arbitrary SQL commands.