Description

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-17T22:17:02.703Z",
  "pubdate": "2026-09-17T22:17:02.703Z",
  "executiveSummary": "CubeCart prior to version 6.7.5 contains an SQL injection vulnerability located in the administrative settings management module.\nThe vulnerability arises from the improper handling of user-supplied input within the 'download_expire' POST parameter, which is concatenated directly into a database UPDATE statement without sufficient validation or parameterization.\nAn authenticated administrator can exploit this flaw to manipulate the application's database structure, potentially altering data in arbitrary columns within the 'CubeCart_downloads' table or other accessible tables.\nThe risk implication is significant as it allows for unauthorized data modification and potential privilege escalation, depending on the database user permissions.\nSuccessful exploitation requires the attacker to possess authenticated administrative access to the CubeCart backend.\nThis vulnerability highlights a critical failure in input sanitization practices, where HTML encoding is incorrectly assumed to be sufficient for preventing injection attacks against backend database queries.",
  "technicalDetails": "The root cause of this vulnerability is the lack of strict numeric validation and the absence of parameterized queries in the 'admin/sources/settings.index.inc.php' file. The application accepts the 'download_expire' POST parameter and concatenates it directly into an SQL UPDATE statement targeting the 'CubeCart_downloads' table.\nBecause the application relies on HTML sanitization rather than database-level input hardening, an attacker can inject SQL syntax characters, such as commas, to escape the intended value context and extend the SET clause of the UPDATE statement.\nThe attack flow proceeds as follows: First, the attacker authenticates to the CubeCart administrative dashboard. Second, the attacker navigates to the settings area where the 'download_expire' value is processed. Third, the attacker intercepts the request or crafts a malicious POST payload where the 'download_expire' parameter contains crafted SQL syntax designed to modify additional columns or inject arbitrary conditions.\nBecause the input is not cast to an integer or treated as a bound parameter, the database driver interprets the malicious string as part of the SQL command, effectively allowing the execution of unauthorized UPDATE logic.\nThe exploitation method relies on the ability to manipulate the structure of the SQL query. For instance, an attacker could supply a payload that injects 'column_name = value' segments into the SET clause, which allows the modification of other fields within the row or table structure.\nThe scope of this vulnerability is limited to authenticated administrators, but within that privilege context, the impact is severe. An attacker could potentially corrupt system configurations, modify access control lists stored in the database, or manipulate product download settings, leading to loss of data integrity or unauthorized access to digital assets.\nThis issue affects all CubeCart versions prior to 6.7.5. The vulnerability persists because the implementation fails to enforce a strict type-check (e.g., ensuring the input is an integer) before including it in the query string, and it ignores the best practice of using prepared statements (PDO or equivalent) to decouple data from code execution."
}