EUVD-2026-59941
GHSA-wgm5-xp28-5cmg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated public parameter (PR:N, UI:N) with easy remote injection (AV:N, AC:L); raw SQL control yields full DB read, write, and potential DoS, so C/I/A all High.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.16 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.
AnalysisAI
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a Joomla site run Phoca Cart 5.0.0-6.1.16 with the public shop items page reachable (the default for any live storefront) and that requests reach the a[] (attribute) or s[] (specification) GET array parameters used by the item filter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high priority, not a paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker browses to the target's public Phoca Cart shop page and submits a crafted request such as items?a[]=1) AND SLEEP(5)-- - , observing response-time delays to confirm blind SQL injection. They then automate boolean/time-based extraction (for example with sqlmap) against the a[] and s[] parameters to dump Joomla user password hashes, customer records, and order data. … |
| Remediation | No vendor-released patch version is identified in the available data; the only reference is the general product page at https://www.phoca.cz/phocacart, so administrators should check that page and the Joomla Extensions Directory for a release newer than 6.1.16 and upgrade to it as the primary fix once confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running Phoca Cart and identify instances of affected versions 5.0.0-6.1.16; immediately deploy Web Application Firewall rules to block SQL metacharacters in a[] and s[] GET parameters on the public shop endpoint; consider network-level access restrictions to the e-commerce extension pending remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacke
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today