Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data. This issue is fixed in version 6.7.5.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected products
- cubecart / v6< 6.7.5 – < 6.7.5
References
- VENDOR_ADVISORYhttps://github.com/cubecart/v6/security/advisories/GHSA-8mmq-8hpq-2h23
- PATCHhttps://github.com/cubecart/v6/commit/2c1a3fc31a8d4aecbc8c4aa02ed878aac4d71879
- MISChttps://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
- PATCHhttps://github.com/cubecart/v6/releases/tag/6.7.5
Updated 2m ago · 8 sources