CubeCart ecommerce software versions before 6.7.0 have an SQL injection vulnerability (CWE-89) in the admin orders-transactions listing page (admin.php?_g=orders&node=transactions). The vulnerability occurs because the 'sort' parameter from the $_GET array is used directly to build an ORDER BY SQL fragment without validating the column name or sort direction. The framework's sqlSafe() function only escapes quote characters, which does not prevent injection in ORDER BY clauses. An authenticated admin with minimum read permissions on orders can exploit this to execute arbitrary SQL queries, potentially extracting sensitive data such as admin password hashes, customer personal information, and payment gateway credentials. The vulnerability is addressed in CubeCart version 6.7.0.

An attacker with authenticated administrator access and minimal read permissions on orders can exploit this vulnerability to perform arbitrary SQL queries on the store database. This can lead to unauthorized disclosure of sensitive information including administrator password hashes, customer personally identifiable information (PII), and integrated payment gateway credentials. The vulnerability does not impact availability or integrity directly but compromises confidentiality.

This vulnerability is fixed in CubeCart version 6.7.0. Users should upgrade to version 6.7.0 or later to remediate this issue. There is no official patch or temporary fix detailed beyond upgrading. Since this is not a cloud service, remediation depends on applying the vendor's fixed version. Patch status is confirmed by the vendor advisory stating the fix is included in 6.7.0.