CVE-2026-54647

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5

Description An issue exists in the ecommerce software where the endpoint 'admin/sources/settings.index.inc.php' directly concatenates the download expire POST parameter into a raw UPDATE statement for CubeCart downloads without numeric validation. An authenticated administrator can provide a comma-delimited value to alter the SET clause, as HTML sanitization does not neutralize SQL syntax. This allows for the manipulation of database columns and other data accessible within the application's database privileges through SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations Update to version 6.7.5.