CubeCart up to 6.7.4 Admin Panel orders.index.inc.php reset_id/delete_card cross-site request forgery

Summaryinfo

A vulnerability has been found in CubeCart up to 6.7.4 and classified as problematic. Impacted is the function reset_id/delete_card of the file admin/sources/orders.index.inc.php of the component Admin Panel. The manipulation leads to cross-site request forgery. This vulnerability is documented as CVE-2026-54642. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in CubeCart up to 6.7.4 and classified as problematic. This issue affects the function reset_id/delete_card of the file admin/sources/orders.index.inc.php of the component Admin Panel. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens. This issue is fixed in version 6.7.5.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-54642 since 06/15/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:admin/sources/orders.index.inc.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 6.7.5 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• CubeCart

Version

• 6.7.0
• 6.7.1
• 6.7.2
• 6.7.3
• 6.7.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion