An SQL injection vulnerability exists in CubeCart prior to version 6.6.0, which allows remote attackers to inject and execute arbitrary SQL commands. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary SQL statements, potentially leading to limited disclosure, modification, or disruption of data within the CubeCart application database. The impact is rated as medium severity with partial loss of confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure of vulnerable CubeCart instances and monitor for updates from CubeCart Limited. No specific temporary mitigations are documented at this time.