EUVD-2026-79290
GHSA-hv62-7458-mg3v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Joomla) · only source for this CVE.
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser (or an automated system that fetches it), causes the resulting redirect to com_j2store's checkout controller to carry attacker-chosen query parameters instead of only the intended view=checkout&task=confirmPayment&orderpayment_type=...&paction=process set - parameter injection/smuggling into that follow-up request. This requires a victim to load the crafted link (UI:R/UI:P); it does not by itself grant an unauthenticated attacker anything they could not already obtain by requesting the target com_j2store URL directly with their own parameters.
AnalysisAI
Parameter smuggling into the PayPal notify redirect of the J2Store extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) lets an attacker-chosen query string ride along with the redirect that the notify endpoint issues to com_j2store's checkout controller, instead of the intended fixed parameter set. A victim must load the crafted link (UI:P in the CVSS 4.0 vector), after which the follow-up request to the checkout controller is processed with the injected view/task/paction parameters, giving a limited integrity impact (VI:L) with no confidentiality or availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
More in J2Store Extension For Joomla
View allMissing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2Sto
Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20,
An arbitrary file read flaw in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0
Unauthenticated blind SQL injection in the J2Store e-commerce extension for Joomla allows remote attackers to extract ar
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious sc
Cross-site request forgery in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22 and 4.1.0–
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, an
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today