CVE-2026-54646
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
HIGH 7.2EPSS 1.4%
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5.
- Affected
- cubecart · v6
- CVSS v3.1 GITHUB
- 7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.45% chance of exploitation in the next 30 days, 73rd percentile
- Published
- 2026-09-17
- Updated
- 2026-09-18