What is the CVSS score of CVE-2026-39358?

CVE-2026-39358 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of CubeCart are affected by CVE-2026-39358?

CubeCart v6.x deployments contain an authenticated SQL injection vulnerability (CVE-2026-39358, CVSS 7.2) allowing privileged administrators to execute arbitrary database queries.. A patch is available.

How to fix or mitigate CVE-2026-39358?

Within 24 hours: review administrative access logs in CubeCart for suspicious activity or unauthorized query patterns. Within 7 days: upgrade all CubeCart v6.x instances to version 6.6.0 or later. Within 30 days: validate data integrity across Products and Logs tables to identify any unauthorized modifications.

CubeCart CVE-2026-39358

EUVD-2026-30156 HIGH

SQL Injection (CWE-89)

2026-05-13 GitHub_M

SQLi Cubecart V6

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:41 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.

AnalysisAI

Authenticated SQL injection in CubeCart v6.x prior to 6.6.0 allows administrative users to execute arbitrary SQL commands through unsanitized sorting parameters on Products and Logs endpoints. Per SSVC, a proof-of-concept exists but the vulnerability is not in CISA KEV, and EPSS scoring (0.03%) reflects very low predicted exploitation activity due to the high-privilege prerequisite.

Technical ContextAI

CubeCart is an open-source PHP/MySQL ecommerce platform widely used by small-to-medium online merchants. The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) realized as time-based blind SQLi, meaning the affected parameters are concatenated into SQL queries (likely ORDER BY clauses) without prepared statements or whitelist validation, and the attacker infers data by observing response delays induced by SQL sleep/benchmark functions. The vulnerable inputs - sort[price], sort_activity, sort_admin, and sort_customer - control row ordering on the Products listing and on administrative Logs views, both of which are reached after authentication. The CPE cpe:2.3:a:cubecart:v6 confirms the entire v6 branch is in scope up to the 6.6.0 fix.

RemediationAI

Vendor-released patch: upgrade CubeCart to version 6.6.0 or later, as documented in GHSA-8gj6-9fwc-h4gh (https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh). If immediate upgrade is not feasible, compensating controls should focus on shrinking the authenticated attack surface: restrict access to the /admin.php (or renamed admin) path via IP allow-listing or VPN to limit who can reach the vulnerable Products and Logs endpoints (trade-off: blocks legitimate remote admin access); enforce strong/unique credentials and MFA on all merchant and staff admin accounts to make privilege-acquisition harder (no functional downside); and deploy a WAF rule that blocks SQL meta-characters and time-function keywords (SLEEP, BENCHMARK, WAITFOR) in the sort[price], sort_activity, sort_admin, and sort_customer parameters (trade-off: false positives on legitimate sort tokens, and easily bypassed by encoding - treat as detection, not prevention). Audit admin user lists and rotate sessions after patching.