CVE-2013-1465

CVE-2013-1465 is a critical PHP object injection vulnerability affecting CubeCart versions 5.0.0 through 5.2.0. An unauthenticated attacker can exploit this flaw by manipulating the 'shipping' parameter in the Cubecart::_basket method, leading to the deserialization of arbitrary PHP objects. This allows for severe impacts, including complete compromise of confidentiality, integrity, and availability of the affected system, as demonstrated by modifying application configurations. While not listed on KEV, an exploit is publicly available on ExploitDB, though there is minimal community discussion or media coverage surrounding this decade-old vulnerability.