What is the CVSS score of CVE-2026-45054?

CVE-2026-45054 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45054?

Yes, a patch is available for CVE-2026-45054. Update the affected software to the latest version immediately.

CubeCart CVE-2026-45054

EUVD-2026-30171 MEDIUM

SQL Injection (CWE-89)

2026-05-13 GitHub_M

PHP SQLi Cubecart V6

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:06 vuln.today

Patch available

May 13, 2026 - 22:03 EUVD

DescriptionGitHub Advisory

CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORDER BY SQL fragment from the attacker-controlled $_GET['sort'] array without column or direction validation. Both the column key and the direction value flow into the query string as bare SQL tokens, and the framework's sqlSafe() (mysqli escape_string) escapes only quote characters - none of which are required for ORDER BY injection. An authenticated administrator with the minimum CC_PERM_READ permission on orders can execute arbitrary SQL against the store database, including time-based blind extraction of admin password hashes, customer PII, and integrated payment-gateway credentials. This vulnerability is fixed in 6.7.0.

AnalysisAI

SQL injection in CubeCart v6 prior to 6.7.0 allows an authenticated administrator to execute arbitrary SQL against the store database via the unsanitized ORDER BY clause on the admin transactions listing page. The admin.php orders-transactions endpoint passes attacker-controlled GET parameters directly into a raw SQL fragment, bypassing the platform's sqlSafe() function which only escapes quote characters - none of which are required for ORDER BY injection. An attacker with at minimum CC_PERM_READ permission on orders can leverage time-based blind SQL injection to extract admin password hashes, customer PII, and integrated payment-gateway credentials. No public exploit identified at time of analysis, though SSVC data indicates POC code exists; the EPSS score of 0.03% (9th percentile) reflects limited observed exploitation interest.

Technical ContextAI

CubeCart is a PHP-based ecommerce platform (CPE: cpe:2.3:a:cubecart:v6:*:*:*:*:*:*:*:*). The root cause is CWE-89 (Improper Neutralization of Special Elements in SQL Commands). The flaw lies specifically in the ORDER BY clause construction: user-supplied values from the $_GET['sort'] array - both the column key and the sort direction - are interpolated directly into the SQL query string as bare tokens. The framework's sqlSafe() wrapper calls mysqli_escape_string(), which escapes quote-delimiting characters but provides no defense against ORDER BY injection because the attack vector does not require quotes. An ORDER BY clause accepts arbitrary SQL expressions, enabling techniques such as conditional time delays (e.g., ORDER BY IF(1=1, SLEEP(5), id)) to blind-extract data one bit at a time. The absence of a column allowlist and direction validation (ASC/DESC) is the direct technical failure.

RemediationAI

The primary fix is to upgrade CubeCart to version 6.7.0, which is confirmed as the patched release per the vendor security advisory at https://github.com/cubecart/v6/security/advisories/GHSA-rm2f-rpcq-6w9f. If immediate upgrade is not possible, operators should apply the following specific compensating controls: restrict access to admin.php at the web server or WAF layer to trusted IP ranges only, which eliminates network-level access to the vulnerable endpoint while accepting the trade-off of reduced administrative flexibility for remote admins; audit and minimize the number of administrator accounts holding CC_PERM_READ on orders, since the vulnerability requires that specific permission; and deploy a WAF rule blocking GET parameters matching patterns consistent with SQL expressions in sort fields (e.g., SLEEP, IF, CASE tokens). These controls reduce exposure but do not eliminate the underlying flaw - upgrade to 6.7.0 remains the authoritative remediation.