# Exploit Title: CubeCart 6.7.4 - Stored Cross-Site Scripting 
# Date: 2026-06-08
# Exploit Author: Mikail Kocadağ (MKLKCDG)
# Vendor Homepage: https://www.cubecart.com/
# Software Link: https://github.com/cubecart/v6
# Vulnerable Version: 6.7.4
# Fixed Version: 6.7.5
# CVE: CVE-2026-54645
# Advisory / References:
https://github.com/cubecart/v6/security/advisories/GHSA-43f6-gfcf-wj9c

--------------------------------------------------------------------------------
VULNERABILITY SUMMARY
--------------------------------------------------------------------------------
A Stored Cross-Site Scripting (XSS) vulnerability exists in the product
management panel of CubeCart 6.7.4, where product descriptions bypass
global input
filters and sanitization controls.

In `admin/sources/products.index.inc.php` (lines 55-59), the application
explicitly
bypasses the global sanitizer mechanism by retrieving content directly from
`$GLOBALS['RAW']['POST']`. The only defense applied is a basic regex filter
against
`<script>` tags, which fails to block alternative XSS vectors like event
handlers
or SVG elements.

--------------------------------------------------------------------------------
IMPACT
--------------------------------------------------------------------------------
An attacker with product editing permissions can inject persistent
malicious JavaScript.
When clients or other administrators view the affected product page on
either the
public storefront or the administration panel, the payload executes within
their
active session.

--------------------------------------------------------------------------------
PROOF OF CONCEPT (PoC)
--------------------------------------------------------------------------------
1. Log into the administration panel and navigate to Product Management.
2. Edit or create a product, and inject a payload using an HTML event
handler into the product description:

   <img src=x onerror=alert(document.domain)>

3. Save the product.
4. Visit the product page on the public storefront or view it within the
admin panel to trigger execution.