CubeCart version 6.7.4 has been identified with an authenticated SQL injection vulnerability (CVE-2026-54647) within the administrative settings module. The flaw occurs because the download_expire POST parameter is directly concatenated into SQL UPDATE statements without proper validation. Since the application's global sanitizer relies solely on htmlspecialchars(), it fails to account for comma injection, allowing attackers to break the intended SQL syntax.
Successful exploitation permits an authenticated administrator to manipulate arbitrary columns within the settings tables or potentially perform lateral movement within the database. Users are strongly advised to upgrade to version 6.7.5, which includes a fix for this vulnerability.
Top comments (0)