EUVD-2026-59941
GHSA-wgm5-xp28-5cmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate public Phoca Cart shop page
-
DeliveryInject SQL via a[]/s[] parameters
-
ExploitConfirm time-based blind response
-
ExecutionAutomate boolean/time-based extraction
-
ImpactDump credentials and customer data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that a Joomla site run Phoca Cart 5.0.0-6.1.16 with the public shop items page reachable (the default for any live storefront) and that requests reach the a[] (attribute) or s[] (specification) GET array parameters used by the item filter. No authentication, no user interaction, and no non-default configuration are needed - the injection sits in the public, unauthenticated listing/filter code path. The main limiting factor is that the site must actually expose the Phoca Cart shop/catalog page publicly and fall within the affected version range; blind time-based extraction is comparatively slow and noisy, which may aid detection but does not prevent full data disclosure. |
| Impact | This is a genuine high priority, not a paper tiger. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) indicates network reach, low complexity, no privileges, and no user interaction, which is fully consistent with an unauthenticated injection on a public storefront page - vector and description agree. Confidentiality, integrity, and availability of the vulnerable database are all rated High, appropriate for full extraction via blind SQLi and possible write/DoS through injection. EPSS is not provided in the input and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation yet; likewise no POC is referenced. The dominant risk driver is exposure: shop pages are internet-facing and unauthenticated, so exploitation needs only crafted requests, and SQLi against a known named parameter is highly automatable once a POC circulates. |
| Exploit ScenarioDerived | An unauthenticated attacker browses to the target's public Phoca Cart shop page and submits a crafted request such as items?a[]=1) AND SLEEP(5)-- - , observing response-time delays to confirm blind SQL injection. They then automate boolean/time-based extraction (for example with sqlmap) against the a[] and s[] parameters to dump Joomla user password hashes, customer records, and order data. No credentials or user interaction are required, so the attack scales across any exposed vulnerable site; no public POC is referenced yet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 16, 2026
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
RemediationAI
No vendor-released patch version is identified in the available data; the only reference is the general product page at https://www.phoca.cz/phocacart, so administrators should check that page and the Joomla Extensions Directory for a release newer than 6.1.16 and upgrade to it as the primary fix once confirmed. Until a fixed version is verified, apply compensating controls: add a WAF rule or Joomla security plugin to block or sanitize requests where the a[] and s[] array parameters contain SQL metacharacters (single quotes, parentheses, SLEEP/BENCHMARK, UNION), accepting that overly broad rules may break legitimate attribute/specification filtering; restrict the database account used by Joomla to least privilege (no FILE privilege, scoped to the site schema) to cap the blast radius of extraction; and if the storefront is not actively used, disable public access to the Phoca Cart items/filter page. Enable request logging on the shop endpoints to detect time-based probing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Phoca Cart is a widely-used shopping-cart component for the Joomla CMS (CPE cpe:2.3:a:phoca.cz:phoca_cart_extension_for_joomla). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the item-listing/filter logic reads the a[] (attribute) and s[] (specification) array parameters from the query string and interpolates their values raw into a WHERE clause built for the underlying Joomla/MySQL (JDatabase) layer, bypassing prepared statements, bound parameters, and the framework's quote/escape helpers. Because these are array parameters, each element is attacker-controlled and reaches the query without type coercion or escaping, giving full control over the filter predicate and enabling boolean/time-based blind extraction.
Know when Phoca Cart Extension For Joomla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated public parameter (PR:N, UI:N) with easy remote injection (AV:N, AC:L); raw SQL control yields full DB read, write, and potential DoS, so C/I/A all High.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.16 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.
Executive ViewAI
Phoca Cart versions 5.0.0-6.1.16 contain a critical SQL injection vulnerability in the public shop page that enables unauthenticated attackers to extract the entire database, including customer credentials, payment data, and order information. Organizations using affected versions face immediate risk of complete customer data compromise with no user interaction required. This exposure creates material regulatory compliance risk (PCI-DSS, GDPR) and operational security impact.
No vendor-released patch identified at time of analysis. Implement Web Application Firewall rules blocking SQL injection patterns in a[] and s[] parameters; apply network segmentation to restrict public access to affected shop endpoints; deploy database activity monitoring to detect anomalous queries and bulk data extraction attempts; enable comprehensive database query logging with real-time alerts for suspicious SQL patterns; enforce least-privilege database credentials for the Phoca Cart application user; consider deploying a database firewall as a secondary control to block injection attempts at the database layer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated remote attackers can download any customer's purchased digital goods from Joomla sites running the Phoca
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacke
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through
Exploit-DB