CubeCart versions 3.0.11 and below "x_invoice_num" blind SQL injection / admin credentials disclosure exploit.