Executive brief
JoomOCShop is an e-commerce integration extension for the Joomla content management system. A security flaw allows an attacker to trick a logged-in user into performing unintended actions, such as changing their account details or resetting their password. This could lead to unauthorized account takeovers or the modification of sensitive customer information.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Joomla JoomOCShop 1.0 extension due to a lack of unique, unpredictable tokens in state-changing requests. An attacker can exploit this by crafting malicious HTML forms that target account management endpoints such as /joomoc2/?route=account/edit or /jcart/account/password.html. If an authenticated user visits a malicious site or clicks a specially crafted link, the attacker can silently submit these forms to modify the user's profile information or reset their password. This vulnerability requires the victim to be authenticated and have an active session with the vulnerable application. No official patch has been identified, as the vendor's site and extension page are currently inactive.
Affected products
- Joomla! extension JoomOCShop 1.0
Timeline
- 2018-05-28: disclosed: Initial exploit published on Exploit-DB
- 2026-05-17: advisory: CVE published and NVD record created