Mklkcdg

**Name of the Vulnerable Software and Affected Versions** CubeCart versions prior to 6.7.5 **Description** Cross-Site Request Forgery (CSRF) occurs when an application allows a user to perform actions without verifying that the request was intentionally initiated by the user. In the file `admin/sources/orders.index.inc.php`, the `reset id` download-counter action and `delete card` stored-payment-card action use state-changing GET requests and are missing from the protection map in `admin/skins/default/csrf.inc.php`. A remote attacker can trick an authenticated administrator into executing these requests without a validated session token, leading to the unauthorized reset of electronic download usage counters or the deletion of stored customer payment-card tokens. **Recommendations** Update to version 6.7.5.

**Name of the Vulnerable Software and Affected Versions** CubeCart versions prior to 6.7.5 **Description** An authenticated administrator without order modification privileges can delete order-history notes, which removes operational records and audit-trail data. This occurs because the delete-note handler in the 'admin/sources/orders.index.inc.php' endpoint only verifies the presence of the `order id` and `delete-note` parameters and does not require the `CC PERM DELETE` permission for orders. **Recommendations** Update to version 6.7.5.

**Name of the Vulnerable Software and Affected Versions** CubeCart versions prior to 6.7.5 **Description** The ` errorMessage()` function in `classes/gui.class.php` uses `strip tags` to allow anchor elements in error, information, and warning messages. However, it fails to filter unsafe `href` values and `onclick` event handlers. An attacker can provide malicious search or input data that bypasses the filter using a `javascript:` URI or event handler. When a user views or interacts with the rendered anchor, JavaScript is executed in their browser session, which can lead to session exposure or unauthorized application actions. **Recommendations** Update to version 6.7.5.

**Name of the Vulnerable Software and Affected Versions** CubeCart versions prior to 6.7.5 **Description** An issue exists where the file 'admin/sources/products.index.inc.php' reads rich-text fields from the `$GLOBALS['RAW']['POST']` variable and only removes script elements before storing and rendering them via Smarty templates. An administrator with product-editing privileges can bypass this filter by using event-handler attributes, SVG content, or javascript: URIs. This leads to persistent JavaScript execution when a storefront visitor or another administrator views the product content, potentially resulting in session exposure or unauthorized actions within the browser context. **Recommendations** Update to version 6.7.5.

**Name of the Vulnerable Software and Affected Versions** CubeCart versions prior to 6.7.5 **Description** An issue exists in the `admin/sources/maintenance.index.inc.php` endpoint where administrator-controlled tablename values are inserted into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without proper validation of identifiers or escaping of embedded backticks. An authenticated administrator can terminate the quoted identifier using a closing backtick to inject structural SQL, which may compromise the confidentiality, integrity, and availability of the database within the application's privileges. **Recommendations** Update to version 6.7.5.

**Name of the Vulnerable Software and Affected Versions** CubeCart versions prior to 6.7.5 **Description** An issue exists in the ecommerce software where the endpoint 'admin/sources/settings.index.inc.php' directly concatenates the `download expire` POST parameter into a raw UPDATE statement for CubeCart downloads without numeric validation. An authenticated administrator can provide a comma-delimited value to alter the SET clause, as HTML sanitization does not neutralize SQL syntax. This allows for the manipulation of database columns and other data accessible within the application's database privileges through SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** Update to version 6.7.5.

**Name of the Vulnerable Software and Affected Versions** CubeCart versions prior to 6.7.5 **Description** An authorization bypass exists in the GDPR tools located in the `admin/sources/customers.gdpr.inc.php` file. The system relies on page-level `CC PERM READ` access and fails to require `CC PERM DELETE` for the `purge`, `no order purge`, and `delete guests` commands. Consequently, an authenticated administrator with only read-only customer privileges can directly invoke these backend actions to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, which compromises data integrity and availability. **Recommendations** Update to version 6.7.5.