Executive brief
jCart is an e-commerce extension that integrates OpenCart shopping features into Joomla websites. A security flaw in this component allows unauthenticated attackers to access and extract sensitive information from the website's database. This could lead to the exposure of customer data, administrative credentials, or proprietary business information.
Technical details
An SQL injection vulnerability exists in the jCart component for Joomla (specifically version 2.0) due to improper neutralization of the 'product_id' parameter. An unauthenticated remote attacker can exploit this by sending a specially crafted GET request to index.php with the parameters 'option=com_jcart&route=product/product'. By injecting malicious SQL code into the 'product_id' field, the attacker can manipulate backend database queries to exfiltrate sensitive data. The vulnerability is classified as CWE-89 and has been verified in public exploit databases.
Affected products
- Soft-Php jCart for OpenCart 2.0
Timeline
- 2017-03-20: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: CVE published and NVD record created