CVE-2025-59335
📋 TL;DR
CubeCart ecommerce software versions before 6.5.11 fail to automatically expire user sessions after password changes. This allows attackers who have compromised an account to maintain access even after the legitimate user changes their password, as the attacker's session remains active. All CubeCart installations running vulnerable versions are affected.
💻 Affected Systems
- CubeCart
📦 What is this software?
Cubecart by Cubecart
⚠️ Risk & Real-World Impact
Worst Case
Account takeover persists indefinitely despite password changes, enabling attackers to steal sensitive customer data, modify orders, access payment information, and maintain persistent control over compromised accounts.
Likely Case
Attackers maintain unauthorized access to user accounts for extended periods, potentially accessing personal information, order history, and performing fraudulent transactions.
If Mitigated
With proper session management controls, attackers lose access immediately upon password change, limiting exposure to the initial compromise window.
🎯 Exploit Status
Exploitation requires initial account compromise through other means (phishing, credential stuffing, etc.), but maintaining access after password change is trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.11
Vendor Advisory: https://github.com/cubecart/v6/security/advisories/GHSA-4vwh-x8m2-fmvv
Restart Required: No
Instructions:
1. Backup your CubeCart installation and database. 2. Download version 6.5.11 from the official CubeCart repository. 3. Replace all files with the patched version. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Manual Session Invalidation
allManually invalidate all active sessions after password changes by clearing session data
DELETE FROM CubeCart_sessions WHERE user_id = [USER_ID];
Reduce Session Lifetime
allConfigure shorter session timeout values to limit exposure window
Modify session.gc_maxlifetime in php.ini or .htaccess to reduce session duration
🧯 If You Can't Patch
- Force all users to log out and create new sessions immediately
- Implement additional authentication factors for sensitive operations
🔍 How to Verify
Check if Vulnerable:
Check CubeCart version in admin panel or examine /includes/global.inc.php for version numberCheck Version:
grep -i 'version' /path/to/cubecart/includes/global.inc.php | head -1Verify Fix Applied:
After updating to 6.5.11, test by changing a user password and verifying active sessions are terminated📡 Detection & Monitoring
Log Indicators:
- Multiple concurrent sessions from different IPs for same user account
- Password change events followed by continued session activity from old IPs
Network Indicators:
- Unusual login patterns with same session IDs persisting across password changes
SIEM Query:
source="cubecart_logs" (event="password_change") AND (same session_id before AND after change)