Two vulnerabilities has been discoverd in CubeCart 4.xx by Russ McRee that can be use by hackers to exploit website by cross-site scripting attacks. The search input string is not properly sanitised before passed to script for execution. This behaviour can be used by attacker to execute malicious script code in the browser to affect website. This may allow to hacker to acess administration by stealing cookies-based aunthentication scheme and destroy website.


CubeCart has been released security patch to fix this problem that can be download from following location.

Also, CubeCart user can fix this manually by editing a single file. Please follow steps described below:

Open and find at around line 134:

$data[$key] = $this->safety($val);

return true;

Replace with:

$data[$key] = $this->safety($val);

All done.



Written by Bala Krishna

Bala Krishna is web developer and occasional blogger from Bhopal, MP, India. He like to share idea, issue he face while working with the code.