CubeCart 6.7.4 - SQL injection

Indicators of Compromise

• exploit-code: # Exploit Title: CubeCart 6.7.4 - SQL injection # Date: 2026-06-08 # Exploit Author: Mikail Kocadağ # Vendor Homepage: https://www.cubecart.com/ # Software Link: https://github.com/cubecart/v6 # Vulnerable Version: 6.7.4 # Fixed Version: 6.7.5 # CVE: CVE-2026-54647 # Advisory / References: https://github.com/cubecart/v6/security/advisories/GHSA-hvmw-v8gc-4c29 -------------------------------------------------------------------------------- VULNERABILITY SUMMARY -------------------------------------------------------------------------------- An authenticated administrative SQL injection vulnerability exists in CubeCart v6.7.4 due to unsafe concatenation of user-supplied input in raw database queries without validation. The vulnerability is located in `admin/sources/settings.index.inc.php` at line 184. The `download_expire` parameter received via POST is directly concatenated into an `UPDATE` SQL statement executed via `query()` or `misc()`. The global input sanitizer (`Sanitize::_safety()`) relies entirely on `htmlspecialchars()`, which does not filter or encode commas (`,`). An attacker can leverage comma injection to break out of the intended syntax and manipulate the `SET` clauses or append malicious clauses. -------------------------------------------------------------------------------- IMPACT -------------------------------------------------------------------------------- An authenticated attacker with access to settings can manipulate arbitrary columns within the settings tables or potentially perform lateral movement within the database. -------------------------------------------------------------------------------- PROOF OF CONCEPT (PoC) -------------------------------------------------------------------------------- 1. Authenticated as an administrator, navigate to Settings. 2. Intercept the save request and inject a payload containing a comma into the `download_expire` field: 1, expire=0 WHERE 1=1-- - 3. Submit the request and verify that the raw SQL syntax is successfully altered.