Cubecart CVE-2026-34018

Q: What is the CVSS score of CVE-2026-34018?

CVE-2026-34018 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23368 MEDIUM

SQL Injection (CWE-89)

2026-04-17 jpcert

SQLi Cubecart Cubecart Limited

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 17, 2026 - 06:22 NVD

6.3 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 17, 2026 - 05:36 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 05:30 euvd

EUVD-2026-23368

Analysis Generated

Apr 17, 2026 - 05:30 vuln.today

CVE Published

Apr 17, 2026 - 04:33 nvd

MEDIUM 5.1

DescriptionCVE.org

An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.

AnalysisAI

SQL injection in CubeCart prior to 6.6.0 allows remote unauthenticated attackers to execute arbitrary SQL statements through a request requiring user interaction, affecting the e-commerce platform's database integrity and confidentiality. The vulnerability has a CVSS score of 6.3 with network-accessible attack vector and low complexity, though exploitation requires user engagement (UI:R) which moderates real-world risk. No public exploit code or active exploitation in CISA KEV has been confirmed at time of analysis.

Technical ContextAI

CubeCart is a PHP-based e-commerce platform that manages shopping carts, products, orders, and customer data within a SQL database backend. The vulnerability stems from insufficient input sanitization in SQL query construction (CWE-89), allowing attacker-controlled parameters to be concatenated directly into SQL statements without proper prepared statements or parameterized queries. The CPE string indicates all versions of CubeCart prior to 6.6.0 are affected, suggesting the flaw exists in core database abstraction or query handling layers used across multiple functional modules. The UI:R requirement in the CVSS vector indicates exploitation requires a victim to interact with a malicious link or form, distinguishing this from direct SQL injection endpoints.

RemediationAI

Upgrade CubeCart to version 6.6.0 or later immediately; this version addresses the SQL injection vulnerability per vendor announcement at https://community.cubecart.com/t/cubecart-6-6-0-released-the-biggest-update-in-years/62405. Before upgrading, backup the CubeCart database and configuration files (config.inc.php). If immediate patching is not feasible, implement the following compensating controls: (1) restrict CubeCart administrative and checkout endpoints via IP whitelist at the web server or firewall level, reducing user population exposed to exploitation; (2) enable Web Application Firewall (WAF) rules to detect and block SQL keywords in parameter payloads (e.g., UNION, SELECT, DROP); note that overly aggressive WAF rules may block legitimate queries; (3) enforce principle of least privilege on the database account used by CubeCart - create a read-only database user for queries that do not require write access, limiting damage if injection occurs. Test all compensating controls in a staging environment before production deployment, as WAF rules may produce false positives affecting legitimate customer transactions.