CyberRota Analysis
AI-GeneratedCubeCart versions prior to 6.7.5 are vulnerable due to improper handling of the download_expire POST parameter, which allows authenticated administrators to manipulate SQL queries and potentially alter database content. This vulnerability poses a significant risk as it can lead to unauthorized data access and modification within the application's database. E-commerce platforms using CubeCart should prioritize upgrading to version 6.7.5 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5.