CubeCart 6.7.4 Cross Site Scripting

# Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php
    # Date: 2026-06-08
    # Exploit Author: Mikail Kocadağ (MKLKCDG)
    # Vendor Homepage: https://www.cubecart.com/
    # Software Link: https://github.com/cubecart/v6
    # Vulnerable Version: 6.7.4
    # Fixed Version: 6.7.5
    # CVE: CVE-2026-54644
    # Advisory / References:
    https://github.com/cubecart/v6/security/advisories/GHSA-v55x-fh73-29vq
    
    --------------------------------------------------------------------------------
    VULNERABILITY SUMMARY
    --------------------------------------------------------------------------------
    The GUI message rendering component in CubeCart 6.7.4 suffers from a
    Cross-Site
    Scripting (XSS) vulnerability due to an insecure `strip_tags` allowlist
    configuration
    that permits harmful attributes inside anchor elements.
    
    In `classes/gui.class.php` (lines 1794-1802), system messages (error, info,
    warning)
    are filtered using `strip_tags($message, '<a>')`. While this strips other
    HTML
    tags, it allows the `<a>` tag to retain all attributes without sanitization.
    
    --------------------------------------------------------------------------------
    IMPACT
    --------------------------------------------------------------------------------
    An attacker passing inputs through search parameters or input fields that
    reflect
    into GUI message components can inject `javascript:` URIs or inline event
    handlers
    (e.g., `onclick`) inside the anchor tag. When rendered in the context of a
    user's
    or administrator's browser session, this allows arbitrary JavaScript
    execution,
    potentially leading to session hijacking or unauthorized administrative
    actions.
    
    --------------------------------------------------------------------------------
    PROOF OF CONCEPT (PoC)
    --------------------------------------------------------------------------------
    1. Trigger a system message wrapper via a search query or input parameter.
    2. Inject an anchor tag payload containing a `javascript:` scheme:
    
       <a href="javascript:alert(1)">Click Here</a>
    
    3. When the user or administrator views or interacts with the rendered
    system alert block,
       the embedded JavaScript payload executes.
    
    
    ------------------------------
    
    
    # Exploit Title: CubeCart 6.7.4 - Stored Cross-Site Scripting 
    # Date: 2026-06-08
    # Exploit Author: Mikail Kocadağ (MKLKCDG)
    # Vendor Homepage: https://www.cubecart.com/
    # Software Link: https://github.com/cubecart/v6
    # Vulnerable Version: 6.7.4
    # Fixed Version: 6.7.5
    # CVE: CVE-2026-54645
    # Advisory / References:
    https://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c
    
    --------------------------------------------------------------------------------
    VULNERABILITY SUMMARY
    --------------------------------------------------------------------------------
    A Stored Cross-Site Scripting (XSS) vulnerability exists in the product
    management panel of CubeCart 6.7.4, where product descriptions bypass
    global input
    filters and sanitization controls.
    
    In `admin/sources/products.index.inc.php` (lines 55-59), the application
    explicitly
    bypasses the global sanitizer mechanism by retrieving content directly from
    `$GLOBALS['RAW']['POST']`. The only defense applied is a basic regex filter
    against
    `<script>` tags, which fails to block alternative XSS vectors like event
    handlers
    or SVG elements.
    
    --------------------------------------------------------------------------------
    IMPACT
    --------------------------------------------------------------------------------
    An attacker with product editing permissions can inject persistent
    malicious JavaScript.
    When clients or other administrators view the affected product page on
    either the
    public storefront or the administration panel, the payload executes within
    their
    active session.
    
    --------------------------------------------------------------------------------
    PROOF OF CONCEPT (PoC)
    --------------------------------------------------------------------------------
    1. Log into the administration panel and navigate to Product Management.
    2. Edit or create a product, and inject a payload using an HTML event
    handler into the product description:
    
       <img src=x onerror=alert(document.domain)>
    
    3. Save the product.
    4. Visit the product page on the public storefront or view it within the
    admin panel to trigger execution.