Description
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- cubecart / v6< 6.7.5 – < 6.7.5
Exploits & proofs of concept
- exploit-dbCubeCart 6.7.4 - SQLby Mikail KOCADAĞ
References
- VENDOR_ADVISORYhttps://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx
- PATCHhttps://github.com/cubecart/v6/commit/fc08d55628191969f2345d06d862df316f7d44d3
- MISChttps://github.com/cubecart/v6/blob/6.7.5/admin/sources/release_notes/6.7.5.inc.php
- PATCHhttps://github.com/cubecart/v6/releases/tag/6.7.5
Updated 39m ago · 8 sources