CubeCart ecommerce software versions before 6.7.0 have an SQL injection vulnerability (CWE-89) in the admin orders-transactions listing page (admin.php?_g=orders&node=transactions). The issue occurs because the 'sort' parameter from the HTTP GET request is incorporated directly into the ORDER BY clause of an SQL query without validating the column or direction values. The framework's sqlSafe() function only escapes quote characters, which does not prevent injection in ORDER BY clauses. An authenticated admin user with minimal read permissions on orders can exploit this to execute arbitrary SQL commands against the store database, including extracting sensitive data such as admin password hashes, customer personally identifiable information, and payment gateway credentials. The vulnerability is addressed in CubeCart version 6.7.0.

An attacker with authenticated administrator access and minimal read permissions on orders can perform SQL injection attacks on the CubeCart database. This can lead to unauthorized disclosure of sensitive information including administrator password hashes, customer personal data, and payment gateway credentials. The vulnerability does not affect availability or integrity directly but compromises confidentiality. No known exploits in the wild have been reported.

This vulnerability is fixed in CubeCart version 6.7.0. Users should upgrade to version 6.7.0 or later to remediate this issue. Since no official patch or temporary workaround is provided in the advisory, upgrading is the recommended and effective mitigation.