CVE-2015-6928

Published: Sep 28, 2015Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a password reset request was made, which allows remote attackers to change the administrator password via a recovery request with a space character in the validate parameter and the administrator email in the email parameter.

Affected (11)

Products: Cubecart: Cubecart

Cubecart

1 product

Cubecart

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Cubecart Cubecart	Version 5.2.12
Cubecart Cubecart	Version 5.2.13
Cubecart Cubecart	Version 5.2.14
Cubecart Cubecart	Version 5.2.15
Cubecart Cubecart	Version 6.0.0
Cubecart Cubecart	Version 6.0.1
Cubecart Cubecart	Version 6.0.2
Cubecart Cubecart	Version 6.0.3
Cubecart Cubecart	Version 6.0.4
Cubecart Cubecart	Version 6.0.5
Cubecart Cubecart	Version 6.0.6