CubeCart SQLi Vulnerability (CVE-2026-39358) Exposes E-commerce Data
The National Vulnerability Database has disclosed CVE-2026-39358, a high-severity authenticated time-based blind SQL Injection vulnerability impacting CubeCart v6.x prior to version 6.6.0. This flaw resides within the sorting parameters of the Products and Logs endpoints, specifically sort[price], sort_activity, sort_admin, and sort_customer.
Attackers who can authenticate to a vulnerable CubeCart instance can leverage these parameters to execute arbitrary SQL commands. This directly threatens the confidentiality and integrity of the underlying database, potentially leading to full data compromise. Such a vulnerability in an e-commerce platform is critical, as it exposes sensitive customer data, order information, and potentially payment details, depending on the system’s architecture.
For defenders, this means a direct path to database compromise for an attacker with legitimate, albeit low-privilege, access. The fix is available in CubeCart 6.6.0, and immediate patching is the only viable mitigation. E-commerce platforms are prime targets; leaving such a critical vulnerability unaddressed is an open invitation for data theft.
What This Means For You
- If your organization uses CubeCart for e-commerce, you must immediately verify your version. Prior to 6.6.0, authenticated attackers can extract or manipulate your entire database. Patch to CubeCart 6.6.0 without delay and audit logs for any suspicious activity related to product or log sorting parameters.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CubeCart Authenticated Time-Based Blind SQLi - CVE-2026-39358
title: CubeCart Authenticated Time-Based Blind SQLi - CVE-2026-39358
id: scw-2026-05-13-ai-1
status: experimental
level: critical
description: |
Detects the specific time-based blind SQL injection attempts targeting CubeCart v6.x prior to 6.6.0. The rule looks for requests to '/products.php' or '/logs.php' containing the vulnerable sorting parameters ('sort[price]', 'sort_activity', 'sort_admin', 'sort_customer') which are indicative of CVE-2026-39358 exploitation.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-39358/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 'sort[price]'
- 'sort_activity'
- 'sort_admin'
- 'sort_customer'
cs-uri|contains:
- '/products.php'
- '/logs.php'
condition: cs-uri-query AND cs-uri
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-39358 | SQLi | CubeCart v6.x prior to 6.6.0 |
| CVE-2026-39358 | SQLi | Vulnerable sorting parameter: sort[price] |
| CVE-2026-39358 | SQLi | Vulnerable sorting parameter: sort_activity |
| CVE-2026-39358 | SQLi | Vulnerable sorting parameter: sort_admin |
| CVE-2026-39358 | SQLi | Vulnerable sorting parameter: sort_customer |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 14, 2026 at 00:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
OPNsense RCE: Critical Flaw Allows Root Access via DHCP Input
CVE-2026-45158 — OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the...
Hoppscotch CVE-2026-44478: Unauthenticated Infrastructure Secret Leak
CVE-2026-44478 — hoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 2026.2.0 addresses the unauthenticated POST /v1/onboarding/config endpoint by checking...
CVE-2026-44471: gitoxide Symlink Vulnerability Exposes Filesystem to Attack
CVE-2026-44471 — gitoxide is an implementation of git written in Rust. Prior to 0.21.1, a malicious tree can be constructed that will, when checked out...