CVE-2026-45054: CubeCart SQL Injection Vulnerability

CVE-2026-45054 Overview

CVE-2026-45054 is a SQL injection vulnerability in CubeCart, an open-source ecommerce software solution. The flaw affects versions prior to 6.7.0 and resides in the admin orders-transactions listing page at admin.php?_g=orders&node=transactions. The page constructs a raw ORDER BY SQL fragment from the attacker-controlled $_GET['sort'] array without validating column names or sort directions. An authenticated administrator holding the minimum CC_PERM_READ permission on orders can inject arbitrary SQL into the store database. The vendor fixed the issue in CubeCart 6.7.0.

Critical Impact

Authenticated administrators with read-only order permissions can extract admin password hashes, customer personally identifiable information (PII), and integrated payment-gateway credentials through time-based blind SQL injection.

Affected Products

• CubeCart versions prior to 6.7.0
• CubeCart admin orders-transactions module (admin.php?_g=orders&node=transactions)
• Deployments where low-privilege admin accounts hold CC_PERM_READ on orders

Discovery Timeline

• 2026-05-13 - CVE-2026-45054 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-45054

Vulnerability Analysis

The vulnerability is a classic ORDER BY SQL injection [CWE-89] in CubeCart's admin orders-transactions listing. The page accepts a sort parameter from the query string as an array, where both the column key and the direction value are concatenated directly into the SQL statement as bare tokens. CubeCart's sqlSafe() wrapper relies on mysqli escape_string, which only neutralizes quote characters, backslashes, and null bytes. None of these characters are required to exploit ORDER BY injection, so the sanitizer offers no protection in this code path.

An attacker with a logged-in admin session and the CC_PERM_READ permission on orders can substitute the column or direction tokens with arbitrary SQL expressions. Because ORDER BY results are observable in HTTP responses only indirectly, attackers typically use time-based blind techniques such as conditional SLEEP() calls to extract data one bit at a time.

Root Cause

The root cause is the absence of an allowlist for sortable columns and directions. The application trusts user input for SQL identifier positions where escaping does not apply. Identifier and keyword contexts in SQL require strict validation against a known set of values, not string escaping.

Attack Vector

Exploitation requires network access to the CubeCart admin interface and a valid administrator session with the CC_PERM_READ privilege on orders. The attacker sends a crafted GET request to admin.php?_g=orders&node=transactions with manipulated sort[column] and sort[direction] values. The injected payload executes within the database query used to render the transactions listing. Time-based blind extraction enables enumeration of the CubeCart_admin_users table, customer records, and stored payment-gateway configuration.

No proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-rm2f-rpcq-6w9f for vendor technical details.

Detection Methods for CVE-2026-45054

Indicators of Compromise

• Admin web server access logs containing _g=orders&node=transactions requests with sort[ parameters that include SQL keywords such as SLEEP, CASE, WHEN, SELECT, or IF(.
• Repeated, near-identical requests to the orders-transactions page from a single admin session with varying delays in response time, indicating time-based extraction.
• Unusual outbound queries or extended response times originating from the CubeCart database process.

Detection Strategies

• Inspect HTTP request logs for sort array parameters whose values are not in the documented column allowlist (order_id, cart_order_id, time, status, etc.).
• Enable MySQL general query log or slow query log and search for ORDER BY clauses containing function calls, subqueries, or conditional expressions.
• Apply web application firewall (WAF) signatures targeting SQL keywords within sort parameters on CubeCart admin endpoints.

Monitoring Recommendations

• Alert on admin session activity that issues high volumes of requests to a single listing endpoint within short windows.
• Track baseline response times for the orders-transactions page and flag sustained deviations consistent with SLEEP()-based blind injection.
• Audit administrator account creation and permission changes, particularly accounts granted only CC_PERM_READ on orders.

How to Mitigate CVE-2026-45054

Immediate Actions Required

• Upgrade CubeCart to version 6.7.0 or later on all production and staging instances.
• Review the CubeCart_admin_users table for unauthorized accounts and rotate all administrator passwords.
• Rotate stored payment-gateway API keys, secrets, and customer-impacting credentials accessible from the store database.

Patch Information

The vendor released a fix in CubeCart 6.7.0. The patch introduces validation of the sort column and direction against an allowlist before incorporating them into the ORDER BY clause. Full details are available in the CubeCart GitHub Security Advisory.

Workarounds

• Restrict access to the CubeCart admin interface using IP allowlists, VPN, or reverse-proxy authentication until the upgrade is applied.
• Remove CC_PERM_READ on orders from non-essential administrator roles to reduce the population of accounts that can reach the vulnerable endpoint.
• Deploy a WAF rule that rejects requests to admin.php?_g=orders&node=transactions containing SQL function names or parentheses inside sort[*] parameters.

# Example WAF rule (ModSecurity) blocking SQL tokens in the sort parameter
SecRule ARGS_NAMES "@rx ^sort\[" \
  "chain,deny,status:403,id:1004505,msg:'CubeCart CVE-2026-45054 ORDER BY injection attempt'"
  SecRule ARGS "@rx (?i)(sleep|benchmark|select|case|when|if\(|union|--|/\*)" \
    "t:none,t:urlDecodeUni"