The vulnerability is a time‑based blind SQL injection that can be triggered via sorting parameters on the Products and Logs endpoints. By manipulating these input fields, an authenticated attacker can execute arbitrary SQL commands against the database. This allows the attacker to read, modify, or delete any data stored in the database, thereby compromising both confidentiality and integrity. The weakness is a classic input validation flaw (CWE‑89).

CubeCart version 6.x before 6.6.0. The affected components are the Products and Logs endpoints in v6.x, specifically the sorting parameters such as sort[price], sort_activity, sort_admin, and sort_customer. All installations of CubeCart 6.0 through 6.5.9 without the patch are vulnerable.

The CVSS score of 7.2 indicates a high severity of the flaw, yet no EPSS score is available, so the current exploitation probability cannot be precisely quantified. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. However, because the flaw requires authentication, the attack is limited to users who have valid credentials or session tokens, but an attacker could potentially compromise privileged accounts. Likely attack vectors involve manipulating the sorting parameters in authenticated requests and observing timing side‑channels to confirm successful SQL execution.