Executive brief
A vulnerability in the EasyStore e-commerce extension for Joomla allows unauthorized individuals to access the website's entire database. This includes sensitive information such as customer records, personal contact details, and encrypted administrator passwords. An attacker could use this access to steal customer data or gain full control over the website, potentially leading to a significant data breach or service disruption.
Technical details
An unauthenticated SQL injection vulnerability exists in the EasyStore extension (versions 1.0.0 through 2.0.1) for Joomla. The flaw is located in the product-list sorting functionality, where the 'order' parameter is improperly validated before being used in a SQL 'ORDER BY' clause. A remote, unauthenticated attacker can exploit this by sending specially crafted web requests to extract sensitive information from the database, including Joomla account hashes, site secrets, and customer PII. The issue was addressed in version 2.0.2 by implementing a strict allow-list for sorting options.
Affected products
- JoomShaper Easy Store extension for Joomla 1.0.0-2.0.1
Timeline
- 2026-07-21: other: Vulnerability reported to vendor by mySites.guru
- 2026-07-23: patched: Version 2.0.2 released by JoomShaper
- 2026-07-23: disclosed: Public disclosure and CVE assignment