An OS command injection flaw in CubeCart allows an attacker who can log in as an administrator to supply arbitrary input that is passed directly to the operating system. The flaw enables the execution of any command on the server, giving full control over the affected system and potentially compromising confidentiality, integrity, and availability.

CubeCart Limited’s CubeCart product in all releases prior to version 6.6.0, including 6.5.x and earlier, is impacted. No specific patch version list is given, so any deployment earlier than 6.6.0 is vulnerable.

The vulnerability has a CVSS score of 8.6, indicating high severity. The likelihood of exploitation is not quantified, and the vulnerability is not classified as a known exploited weakness in public repositories. The likely attack path requires an attacker to obtain administrative credentials or exploit an existing admin session, after which arbitrary OS commands can be executed. The absence of an application-layer restriction and the direct use of user input in system calls make exploitation straightforward for a qualified attacker.