CVE-2026-54642: CWE-352: Cross-Site Request Forgery (CSRF) in cubecart v6
CubeCart v6 prior to version 6.7.5 contains a Cross-Site Request Forgery (CSRF) vulnerability affecting certain state-changing GET requests in the admin interface. Specifically, the reset_id download-counter and delete_card stored-payment-card actions lack proper CSRF protection, allowing a remote attacker to trick an authenticated administrator into performing unintended actions. This vulnerability is fixed in version 6.7.5.
AI Analysis
Technical Summary
CubeCart ecommerce software versions before 6.7.5 have a CSRF vulnerability (CWE-352) in the admin/sources/orders.index.inc.php file. The reset_id download-counter and delete_card stored-payment-card actions use state-changing GET requests that are not protected by a validated session token due to omission from the CSRF protection map in admin/skins/default/csrf.inc.php. An attacker can exploit this by inducing an authenticated administrator to issue these requests, resulting in unintended resets of electronic download counters or deletion of stored customer payment card tokens. The issue is resolved in CubeCart version 6.7.5.
Potential Impact
An attacker can cause an authenticated administrator to unknowingly reset download counters or delete stored payment card tokens via CSRF attacks. This can disrupt ecommerce operations by resetting usage counters or removing customer payment information without authorization. There is no indication of remote code execution or data disclosure beyond these state changes.
Mitigation Recommendations
Upgrade CubeCart to version 6.7.5 or later, where this CSRF vulnerability is fixed. Until then, administrators should be cautious with links and requests that could trigger these actions. No other vendor advisory mitigation is provided.
CVE-2026-54642: CWE-352: Cross-Site Request Forgery (CSRF) in cubecart v6
Description
CubeCart v6 prior to version 6.7.5 contains a Cross-Site Request Forgery (CSRF) vulnerability affecting certain state-changing GET requests in the admin interface. Specifically, the reset_id download-counter and delete_card stored-payment-card actions lack proper CSRF protection, allowing a remote attacker to trick an authenticated administrator into performing unintended actions. This vulnerability is fixed in version 6.7.5.
CVSS v4.0
Score 5.3medium
Affected software
cubecart
v6
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CubeCart ecommerce software versions before 6.7.5 have a CSRF vulnerability (CWE-352) in the admin/sources/orders.index.inc.php file. The reset_id download-counter and delete_card stored-payment-card actions use state-changing GET requests that are not protected by a validated session token due to omission from the CSRF protection map in admin/skins/default/csrf.inc.php. An attacker can exploit this by inducing an authenticated administrator to issue these requests, resulting in unintended resets of electronic download counters or deletion of stored customer payment card tokens. The issue is resolved in CubeCart version 6.7.5.
Potential Impact
An attacker can cause an authenticated administrator to unknowingly reset download counters or delete stored payment card tokens via CSRF attacks. This can disrupt ecommerce operations by resetting usage counters or removing customer payment information without authorization. There is no indication of remote code execution or data disclosure beyond these state changes.
Mitigation Recommendations
Upgrade CubeCart to version 6.7.5 or later, where this CSRF vulnerability is fixed. Until then, administrators should be cautious with links and requests that could trigger these actions. No other vendor advisory mitigation is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T20:16:46.198Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aac671555bf5e2cf5ffd68a
Added to database: 09/17/2026, 22:17:57 UTC
Last enriched: 09/17/2026, 22:31:54 UTC
Last updated: 09/17/2026, 22:37:11 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.