Esta página ainda não foi traduzida para o seu idioma. Exibindo conteúdo em inglês enquanto trabalhamos nisso.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-39358: SQL Injection in CubeCart Ecommerce
Plataforma
php
Componente
cubecart
Corrigido em
6.6.0
CVE-2026-39358 describes an authenticated Time-Based Blind SQL Injection vulnerability discovered in CubeCart, an ecommerce software solution. This flaw allows attackers to inject malicious SQL commands through sorting parameters, potentially leading to data breaches and system compromise. The vulnerability impacts CubeCart versions 6.0.0 up to, but not including, version 6.6.0. A patch is available in version 6.6.0.
Impacto e Cenários de Ataquetraduzindo…
Successful exploitation of CVE-2026-39358 allows an attacker to bypass authentication and execute arbitrary SQL queries against the CubeCart database. This could result in the theft of sensitive customer data, including usernames, passwords, addresses, and payment information. Attackers could also modify product data, pricing, or inventory levels, disrupting business operations. The blind nature of the injection means that data extraction is slower, but the potential impact remains significant. A compromised CubeCart instance could also be leveraged for lateral movement within the network if the database user has excessive privileges.
Contexto de Exploraçãotraduzindo…
CVE-2026-39358 was published on May 13, 2026. Its severity is rated HIGH with a CVSS score of 7.2. No public exploits or active campaigns targeting this vulnerability have been observed as of the publication date. The vulnerability is not currently listed on CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is pending evaluation.
Inteligência de Ameaças
Status do Exploit
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Alto — conta de administrador ou privilegiada necessária.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Alto — o atacante pode escrever, modificar ou excluir qualquer dado.
- Availability
- Alto — falha completa ou esgotamento de recursos. Negação de serviço total.
Software Afetado
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
- Modificada
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2026-39358 is to immediately upgrade CubeCart to version 6.6.0 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to filter out malicious SQL injection attempts targeting the sorting parameters (sort[price], sortactivity, sortadmin, and sort_customer) of the Products and Logs endpoints. Input validation and sanitization on the server-side are also crucial. Review database user permissions to ensure they adhere to the principle of least privilege; limit the database user's access to only the necessary tables and operations. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection attack on the affected endpoints and verifying that the input is properly sanitized.
Como corrigirtraduzindo…
Actualice CubeCart a la versión 6.6.0 o posterior para mitigar la vulnerabilidad de inyección SQL ciega basada en tiempo. Asegúrese de realizar una copia de seguridad de su base de datos antes de actualizar. Verifique la documentación oficial de CubeCart para obtener instrucciones detalladas de actualización.
Perguntas frequentestraduzindo…
What is CVE-2026-39358 — SQL Injection in CubeCart?
CVE-2026-39358 is a SQL Injection vulnerability affecting CubeCart versions 6.0.0 through 6.5.9. Attackers can exploit sorting parameters to execute arbitrary SQL commands, potentially compromising the database.
Am I affected by CVE-2026-39358 in CubeCart?
If you are running CubeCart version 6.0.0 through 6.5.9, you are potentially affected by this vulnerability. Upgrade to version 6.6.0 to mitigate the risk.
How do I fix CVE-2026-39358 in CubeCart?
The recommended fix is to upgrade CubeCart to version 6.6.0 or later. As a temporary workaround, implement a WAF to filter malicious SQL injection attempts.
Is CVE-2026-39358 being actively exploited?
As of the publication date, there are no reports of active exploitation campaigns targeting CVE-2026-39358.
Where can I find the official CubeCart advisory for CVE-2026-39358?
Refer to the official CubeCart security advisory for detailed information and updates regarding CVE-2026-39358: [https://www.cubecart.com/security/advisories/](https://www.cubecart.com/security/advisories/)
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Experimente agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...