CubeCart 6.7.4 - Cross-Site Scripting

# Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting
Attribute Injection in gui.class.php
# Date: 2026-06-08
# Exploit Author: Mikail Kocadağ (MKLKCDG)
# Vendor Homepage: https://www.cubecart.com/
# Software Link: https://github.com/cubecart/v6
# Vulnerable Version: 6.7.4
# Fixed Version: 6.7.5
# CVE: CVE-2026-54644
# Advisory / References:
https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq

--------------------------------------------------------------------------------
VULNERABILITY SUMMARY
--------------------------------------------------------------------------------
The GUI message rendering component in CubeCart 6.7.4 suffers from a
Cross-Site
Scripting (XSS) vulnerability due to an insecure `strip_tags` allowlist
configuration
that permits harmful attributes inside anchor elements.

In `classes/gui.class.php` (lines 1794-1802), system messages (error, info,
warning)
are filtered using `strip_tags($message, '<a>')`. While this strips other
HTML
tags, it allows the `<a>` tag to retain all attributes without sanitization.

--------------------------------------------------------------------------------
IMPACT
--------------------------------------------------------------------------------
An attacker passing inputs through search parameters or input fields that
reflect
into GUI message components can inject `javascript:` URIs or inline event
handlers
(e.g., `onclick`) inside the anchor tag. When rendered in the context of a
user's
or administrator's browser session, this allows arbitrary JavaScript
execution,
potentially leading to session hijacking or unauthorized administrative
actions.

--------------------------------------------------------------------------------
PROOF OF CONCEPT (PoC)
--------------------------------------------------------------------------------
1. Trigger a system message wrapper via a search query or input parameter.
2. Inject an anchor tag payload containing a `javascript:` scheme:

   <a href="javascript:alert(1)">Click Here</a>

3. When the user or administrator views or interacts with the rendered
system alert block,
   the embedded JavaScript payload executes.