# Exploit Title: CubeCart 6.7.4 - SQL
Bypass in maintenance.index.inc.php
# Date: 2026-06-08
# Exploit Author: Mikail Kocadağ
# Vendor Homepage: https://www.cubecart.com/
# Software Link: https://github.com/cubecart/v6
# Vulnerable Version: 6.7.4
# Fixed Version: 6.7.5
# CVE: CVE-2026-54646
# Advisory / References:
https://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx
--------------------------------------------------------------------------------
VULNERABILITY SUMMARY
--------------------------------------------------------------------------------
An authenticated administrative SQL injection vulnerability via identifier
injection
exists in the maintenance component of CubeCart 6.7.4.
In `admin/sources/maintenance.index.inc.php` at line 551, user-supplied
table names
from POST parameters are wrapped in backticks (`) and passed directly into
structural
SQL statements like `ALTER TABLE`, `CHECK TABLE`, or `ANALYZE TABLE`.
Because the global `htmlspecialchars` sanitizer does not alter backticks,
an attacker
can supply a closing backtick followed by SQL commands to perform arbitrary
database
operations.
--------------------------------------------------------------------------------
IMPACT
--------------------------------------------------------------------------------
An authenticated administrator can break out of the table identifier
enclosure
and execute arbitrary SQL statements. This can result in complete
compromise of
the database structure and data depending on the database user's privileges.
--------------------------------------------------------------------------------
PROOF OF CONCEPT (PoC)
--------------------------------------------------------------------------------
1. Log into the administration panel with database maintenance capabilities.
2. Navigate to Database Maintenance toolkit.
3. Select a database table action and inject a closing backtick within the
table name POST parameter:
mytable`; [MALICIOUS_SQL]-- -
4. Submit the request to observe the execution of arbitrary SQL commands.
