Authenticated database compromise via unchecked sorting arrays

SQL injection in CubeCart before 6.6.0 allows remote authenticated users to read and modify database data through sorting parameters. The Products and Logs handlers verify only that each supplied sort value is an array, then pass its unchecked contents directly to database select calls. An active administrator session is required; crafted sort values can trigger time delays and support blind extraction or modification of database records.