Vulnerabilidades de Cubecart

CVE-2026-45714 Crítica · 9.1 CWE-94 13/05/2026

Injeção de Template no Lado do Servidor no CubeCart com Execução de Comandos (CVE-2026-45714)

O CubeCart é uma solução de software para e-commerce. Antes da versão 6.7.0, existe uma vulnerabilidade de Server-Side Template Injection (SSTI) autenticada em múltiplos módulos do CubeCart (incluindo Modelos de E-mail, Faturas, Documentos e Formulários de Contato). A aplicação avalia de forma insegura a entrada fornecida pelo usuário utilizando o mecanismo de templates Smarty sem habilitar as Políticas de Segurança do Smarty. Isso permite que qualquer usuário autenticado com privilégios administrativos execute comandos arbitrários no sistema operacional do servidor (RCE). Esta vulnerabilidade está corrigida na versão 6.7.0.

CVE-2026-45708 Alta · 7.2 CWE-94 13/05/2026

CubeCart: Authenticated RCE via Invoice Template → Order Print

CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. files/.htaccess ships an explicit <Files print.*.php> allow from all </Files> carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3.

CVE-2026-45055 Alta · 8.1 CWE-20 13/05/2026

CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header

CubeCart is an ecommerce software solution. Prior to 6.7.2, CubeCart 6.6.x – 6.7.1 builds CC_STORE_URL directly from the Host request header at bootstrap, with no allowlist. The constant is embedded verbatim into transactional email links, most critically the password-reset link in User::passwordRequest() (and the admin equivalent in Admin::passwordRequest()). An unauthenticated attacker who knows a target email can POST /index.php?_a=recover with Host: evil.com; CubeCart writes a fresh verify token (valid 3,600 s) and emails the victim a link http://evil.com/index.php?_a=recovery&validate=<TOKEN>. The token is valid against the legitimate store — capturing the victim's click on evil.com yields full account takeover, or store takeover when an admin email is targeted. This vulnerability is fixed in 6.7.2.

CVE-2026-45054 Média · 4.9 CWE-89 13/05/2026

CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing

CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORDER BY SQL fragment from the attacker-controlled $_GET['sort'] array without column or direction validation. Both the column key and the direction value flow into the query string as bare SQL tokens, and the framework's sqlSafe() (mysqli escape_string) escapes only quote characters — none of which are required for ORDER BY injection. An authenticated administrator with the minimum CC_PERM_READ permission on orders can execute arbitrary SQL against the store database, including time-based blind extraction of admin password hashes, customer PII, and integrated payment-gateway credentials. This vulnerability is fixed in 6.7.0.

CVE-2026-45053 Crítica · 9.1 CWE-434 13/05/2026

CubeCart API REST Gerenciador de Arquivos: upload arbitrário de arquivos autenticado (CVE-2026-45053)

CubeCart é uma solução de software de e-commerce. Antes da versão 6.7.0, existe uma vulnerabilidade de upload arbitrário de arquivos autenticado no endpoint do Gerenciador de Arquivos da API REST (POST /api/v1/files) do CubeCart. O endpoint permite que qualquer detentor de uma chave de API com permissão files:rw envie arquivos-fonte PHP para o diretório images/source/, acessível pela web, onde são executados pelo servidor web. Combinado com uma falha de path traversal no parâmetro filepath do mesmo endpoint, uma única requisição à API grava um webshell em qualquer local onde o processo do servidor web tenha permissão de escrita, incluindo a raiz do documento, resultando em Remote Code Execution completa. Esta vulnerabilidade está corrigida na versão 6.7.0.

CVE-2026-44377 Crítica · 9.1 CWE-94 13/05/2026

CubeCart: SSTI autenticada em templates Smarty leva a RCE

CubeCart é uma solução de software de e-commerce. Antes da versão 6.7.0, existe uma vulnerabilidade de Server-Side Template Injection (SSTI) autenticada em múltiplos módulos do CubeCart (incluindo Modelos de E-mail e Documentos). A aplicação avalia de forma insegura entradas fornecidas pelo usuário diretamente pelo mecanismo de templates Smarty. Ao explorar isso, um atacante autenticado com privilégios administrativos pode contornar as restrições atuais e chamar funções nativas do PHP dentro dos templates, como readgzfile() para ler arquivos de configuração sensíveis, ou error_log() para gravar uma web shell PHP maliciosa, resultando em divulgação de informações e execução remota de código (RCE) completa. Esta vulnerabilidade está corrigida na versão 6.7.0.

CVE-2026-44376 Média · 6.1 Exploit público CWE-79 13/05/2026

CubeCart: Reflected XSS in Store Search Bar

CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.php, user input is reflected without sanitization only when a search returns exactly one product. This flaw bypasses current filters, allowing an attacker to execute malicious JavaScript in the victim's browser, leading to session hijacking, site defacement, or phishing. This vulnerability is fixed in 6.7.0.

CVE-2026-39428 Média · 4.8 CWE-79 13/05/2026

CubeCart: Stored Cross-Site Scripting (XSS)

CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with administrative privileges can inject malicious JavaScript payloads into multiple fields during the creation or modification of a product. These payloads are stored in the database and executed whenever a user (customer or another administrator) views the affected product pages, which could lead to session hijacking or unauthorized actions. This vulnerability is fixed in 6.6.0.

CVE-2026-39358 Alta · 7.2 CWE-89 13/05/2026

CubeCart: Time-based Blind SQL Injection

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.

CVE-2026-35496 Baixa · 2.7 CWE-22 17/04/2026

Path Traversal em Cubecart

A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be accessible.

CVE-2026-34018 Crítica · 9.8 CWE-89 17/04/2026

SQL Injection em Cubecart

An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.

CVE-2026-21719 Alta · 7.2 CWE-78 17/04/2026

OS Command Injection em Cubecart

An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.