CyberRota Analysis
AI-GeneratedCubeCart versions prior to 6.7.5 are vulnerable due to improper validation of administrator-controlled tablename values in SQL statements, allowing authenticated administrators to inject malicious SQL code. This could lead to significant risks, including the compromise of database confidentiality, integrity, and availability. E-commerce operators using affected versions should prioritize upgrading to version 6.7.5 to mitigate these vulnerabilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.