EUVD-2026-30156Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.
AnalysisAI
Authenticated SQL injection in CubeCart v6.x prior to 6.6.0 allows administrative users to execute arbitrary SQL commands through unsanitized sorting parameters on Products and Logs endpoints. Per SSVC, a proof-of-concept exists but the vulnerability is not in CISA KEV, and EPSS scoring (0.03%) reflects very low predicted exploitation activity due to the high-privilege prerequisite.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with high-privileged (administrator-level) access to the CubeCart admin panel, as confirmed by CVSS PR:H, since the vulnerable sort[price], sort_activity, sort_admin, and sort_customer parameters are reached only through the Products and Logs administrative endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk is moderate but heavily gated by the privilege requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained CubeCart administrative credentials - through phishing, credential reuse from a third-party breach, or a malicious staff account - logs into the admin panel and issues crafted requests to the Products or Logs endpoint with a time-based blind SQLi payload in the sort_admin or sort[price] parameter. By measuring response delays, they bit-by-bit extract the contents of the database, including the customers table (PII, hashed passwords) and the orders table (transaction data). … |
| Remediation | Vendor-released patch: upgrade CubeCart to version 6.6.0 or later, as documented in GHSA-8gj6-9fwc-h4gh (https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: review administrative access logs in CubeCart for suspicious activity or unauthorized query patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today