CubeCart’s order‑transaction listing endpoint builds an ORDER BY clause directly from the $_GET['sort'] array. The column key and sort direction are inserted without validation or parameterization, allowing a malicious administrator with the basic CC_PERM_READ permission to inject arbitrary SQL through the sort[] parameter. This injection can extract any data from the database, including administrator password hashes, customer personally identifiable information, and payment gateway credentials. The vulnerability is a classic SQL injection (CWE‑89).

CubeCart version 6, specifically all releases before 6.7.0, are affected. The issue was fixed in the 6.7.0 update, which properly sanitizes the ORDER BY input.

The CVSS score is 4.9, indicating low severity. No EPSS score is published, so current exploit probability is unknown. Conservation of the vulnerability in the CISA KEV list is not indicated. The attack vector requires prior authenticated access to the CubeCart admin area and the CC_PERM_READ permission on orders, which is typically limited to trusted administrators. However, the privilege level required is sufficient to compromise data integrity and confidentiality. Until the official update is applied, the risk of credential theft or other sensitive data leakage remains.