CVE-2026-45054 CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
Authenticated administrators can execute arbitrary SQL via the sort parameter in CubeCart, enabling extraction of sensitive data and credentials.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45054?
CVE-2026-45054 is a medium-severity SQL injection vulnerability in cubecart v6, published on 13 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORDER BY SQL fragment from the attacker-controlled $_GET['sort'] array without column or direction validation. Both the column key and the direction value flow into the query string as bare SQL tokens, and the framework's sqlSafe() (mysqli escape_string) escapes only quote characters — none of which are required for ORDER BY injection. An authenticated administrator with the minimum CC_PERM_READ permission on orders can execute arbitrary SQL against the store database, including time-based blind extraction of admin password hashes, customer PII, and integrated payment-gateway credentials. This vulnerability is fixed in 6.7.0.
Weakness: CWE-89
Which versions are affected by CVE-2026-45054?
How do I fix CVE-2026-45054?
No fix has been published for CVE-2026-45054 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-45054 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45054 exists.
Sources
Also known as GHSA-rm2f-rpcq-6w9f.