CubeCart 6.7.4 SQL Injection

# Exploit Title: CubeCart 6.7.4 - SQL Bypass in maintenance.index.inc.php
    # Date: 2026-06-08
    # Exploit Author: Mikail Kocadağ
    # Vendor Homepage: https://www.cubecart.com/
    # Software Link: https://github.com/cubecart/v6
    # Vulnerable Version: 6.7.4
    # Fixed Version: 6.7.5
    # CVE: CVE-2026-54646
    # Advisory / References:
    https://github.com/cubecart/v6/security/advisories/GHSA-qcx6-cg43-ffmx
    
    --------------------------------------------------------------------------------
    VULNERABILITY SUMMARY
    --------------------------------------------------------------------------------
    An authenticated administrative SQL injection vulnerability via identifier
    injection
    exists in the maintenance component of CubeCart 6.7.4.
    
    In `admin/sources/maintenance.index.inc.php` at line 551, user-supplied
    table names
    from POST parameters are wrapped in backticks (`) and passed directly into
    structural
    SQL statements like `ALTER TABLE`, `CHECK TABLE`, or `ANALYZE TABLE`.
    
    Because the global `htmlspecialchars` sanitizer does not alter backticks,
    an attacker
    can supply a closing backtick followed by SQL commands to perform arbitrary
    database
    operations.
    
    --------------------------------------------------------------------------------
    IMPACT
    --------------------------------------------------------------------------------
    An authenticated administrator can break out of the table identifier
    enclosure
    and execute arbitrary SQL statements. This can result in complete
    compromise of
    the database structure and data depending on the database user's privileges.
    
    --------------------------------------------------------------------------------
    PROOF OF CONCEPT (PoC)
    --------------------------------------------------------------------------------
    1. Log into the administration panel with database maintenance capabilities.
    2. Navigate to Database Maintenance toolkit.
    3. Select a database table action and inject a closing backtick within the
    table name POST parameter:
    
       mytable`; [MALICIOUS_SQL]-- -
    
    4. Submit the request to observe the execution of arbitrary SQL commands.
    
    
    -------------------
    
    
    # Exploit Title: CubeCart 6.7.4 - SQL injection
    # Date: 2026-06-08
    # Exploit Author: Mikail Kocadağ
    # Vendor Homepage: https://www.cubecart.com/
    # Software Link: https://github.com/cubecart/v6
    # Vulnerable Version: 6.7.4
    # Fixed Version: 6.7.5
    # CVE: CVE-2026-54647
    # Advisory / References:
    https://github.com/cubecart/v6/security/advisories/GHSA-hvmw-v8gc-4c29
    
    --------------------------------------------------------------------------------
    VULNERABILITY SUMMARY
    --------------------------------------------------------------------------------
    An authenticated administrative SQL injection vulnerability exists in
    CubeCart v6.7.4
    due to unsafe concatenation of user-supplied input in raw database queries
    without validation.
    
    The vulnerability is located in `admin/sources/settings.index.inc.php` at
    line 184.
    The `download_expire` parameter received via POST is directly concatenated
    into an
    `UPDATE` SQL statement executed via `query()` or `misc()`.
    
    The global input sanitizer (`Sanitize::_safety()`) relies entirely on
    `htmlspecialchars()`,
    which does not filter or encode commas (`,`). An attacker can leverage
    comma injection
    to break out of the intended syntax and manipulate the `SET` clauses or
    append malicious clauses.
    
    --------------------------------------------------------------------------------
    IMPACT
    --------------------------------------------------------------------------------
    An authenticated attacker with access to settings can manipulate arbitrary
    columns
    within the settings tables or potentially perform lateral movement within
    the database.
    
    --------------------------------------------------------------------------------
    PROOF OF CONCEPT (PoC)
    --------------------------------------------------------------------------------
    1. Authenticated as an administrator, navigate to Settings.
    2. Intercept the save request and inject a payload containing a comma into
    the `download_expire` field:
    
       1, expire=0 WHERE 1=1-- -
    
    3. Submit the request and verify that the raw SQL syntax is successfully
    altered.