CVE-2026-45054: SQL Injection in CubeCart v6

An attacker exploiting this SQL Injection vulnerability could gain unauthorized access to the CubeCart database. This could lead to the exfiltration of sensitive customer data, including personally identifiable information (PII) like names, addresses, and payment details. Furthermore, depending on the database configuration and permissions, an attacker might be able to modify or delete data, disrupt store operations, or even gain control of the underlying server. The impact is amplified by the ecommerce nature of CubeCart, which typically handles significant volumes of sensitive data. Successful exploitation could result in significant financial and reputational damage for affected businesses.

1. 已保留2026-05-08
2. 发布日期2026-05-13
3. 修改日期2026-05-14

The primary mitigation for CVE-2026-45054 is to upgrade CubeCart to version 6.7.0 or later, which contains the necessary fix. If an immediate upgrade is not possible, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious SQL fragments in the sort parameter of the admin.php?_g=orders&node=transactions endpoint. Specifically, look for unusual characters or SQL keywords within the sort parameter. Additionally, review and restrict database user permissions to limit the potential impact of a successful SQL Injection attack. After upgrading, confirm the vulnerability is resolved by attempting a SQL Injection payload in the affected endpoint and verifying that it is properly sanitized.