CubeCart 6.7.4 – Stored XSS
# Exploit Title: CubeCart 6.7.4 - Stored Cross-Site Scripting # Date: 2026-06-08 # Exploit Author: Mikail Kocadağ (MKLKCDG) # Vendor Homepage: https://www.cubecart.com/ # Software Link: https://github.com/cubecart/v6 # Vulnerable Version: 6.7.4 # Fixed Version: 6.7.5 # CVE: CVE-2026-54645 # Advisory / References: https://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c -------------------------------------------------------------------------------- VULNERABILITY SUMMARY -------------------------------------------------------------------------------- A Stored Cross-Site Scripting (XSS) vulnerability exists in the product management panel of CubeCart 6.7.4, where product descriptions bypass global input filters and sanitization controls. In `admin/sources/products.index.inc.php` (lines 55-59), the application explicitly bypasses the global sanitizer mechanism by retrieving content directly from `$GLOBALS['RAW']['POST']`. The only defense applied is a basic regex filter against `<script>` tags, which fails to block alternative XSS vectors like event handlers or SVG elements. -------------------------------------------------------------------------------- IMPACT -------------------------------------------------------------------------------- An attacker with product editing permissions can inject persistent malicious JavaScript. When clients or other administrators view the affected product page on either the public storefront or the administration panel, the payload executes within their active session. -------------------------------------------------------------------------------- PROOF OF CONCEPT (PoC) -------------------------------------------------------------------------------- 1. Log into the administration panel and navigate to Product Management. 2. Edit or create a product, and inject a payload using an HTML event handler into the product description: <img src=x onerror=alert(document.domain)> 3. Save the product. 4. Visit the product page on the public storefront or view it within the admin panel to trigger execution. |