CVE-2026-45714: RCE in CubeCart v6 Ecommerce Software

The impact of this RCE vulnerability is severe. An attacker, posing as an authenticated administrative user, can gain complete control over the affected CubeCart server. This includes the ability to install malware, steal sensitive data (customer information, payment details, database contents), modify website content, and potentially pivot to other systems on the network. The exploitation pattern resembles classic SSTI attacks, where template engines are misused to execute arbitrary code. Successful exploitation could lead to a complete compromise of the ecommerce platform and associated data, resulting in significant financial and reputational damage.

1. 已保留2026-05-13
2. 发布日期2026-05-13

The primary mitigation is to immediately upgrade CubeCart to version 6.7.0, which addresses the SSTI vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict administrative access to the CubeCart platform and enforce strong password policies. Implement a Web Application Firewall (WAF) with rules to detect and block SSTI attempts, specifically targeting Smarty template injection patterns. Monitor CubeCart logs for suspicious activity, such as unusual template rendering or command execution attempts. After upgrading, confirm the fix by attempting to trigger the SSTI vulnerability through administrative interfaces and verifying that the commands are properly sanitized.