A classic SQL injection flaw allows an attacker to execute arbitrary SQL commands against the database. If exploited, an attacker could read sensitive information, modify or delete data, and potentially gain administrative access through the vulnerable e‑commerce platform.

CubeCart Limited’s CubeCart platform prior to version 6.6.0 is vulnerable. All releases older than 6.6.0 may be affected, with no specific patch noted for individual minor revisions.

The CVSS score of 5.1 indicates a moderate risk level. Exploitation likelihood has not been quantified. The vulnerability is not listed in the known exploited vulnerabilities catalog. Attack vectors are likely remote, using crafted HTTP requests targeting user input fields, with no special prerequisites beyond access to the application.