Easy Store Extension For Joomla
Monthly
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
PII harvesting in JoomShaper EasyStore 1.0.0-3.0.0 allows unauthenticated attackers to enumerate guest checkout records via the checkout.searchGuestUser endpoint, which returns full shipping details (name, phone, address) for any supplied email address. Despite vendor labeling as an authenticated SQL injection, the endpoint requires no authentication or session validation and enables bulk collection of customer PII. No public exploit code has been identified at time of analysis; the vendor has resolved the issue by removing the server-side endpoint and migrating autofill to client-side localStorage.
CSRF in JoomShaper EasyStore for Joomla versions 1.0.0 through 3.0.0 allows an attacker to silently modify the core Joomla mail sender name and address (fromname, mailfrom) in configuration.php by tricking a logged-in administrator into visiting a malicious web page. The vulnerable endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration lacks anti-CSRF token validation and administrative authorization checks. Exploitation requires an authenticated admin session (UI:R) but no attacker credentials (PR:N); impact is limited to altering mail sender identity, and no public exploit was identified at time of analysis.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.
EasyStore for Joomla versions 1.0.0 through 3.0.0 does not enforce CSRF token verification across most administrator AJAX endpoints, enabling an attacker to trick a logged-in Joomla administrator into changing store data such as orders, coupons, media, customers, settings, tags, categories, reviews, and collections. Only the products() action checked tokens; the vendor fix moves verification into ApiController::execute() and applies Session::checkToken() to POST, PUT, PATCH, and DELETE requests. No public exploit code was identified at time of analysis, and exploitation requires an active admin session plus user interaction, so this is a moderate-risk CSRF issue despite the potential for high integrity and availability impact.
PII harvesting in JoomShaper EasyStore 1.0.0-3.0.0 allows unauthenticated attackers to enumerate guest checkout records via the checkout.searchGuestUser endpoint, which returns full shipping details (name, phone, address) for any supplied email address. Despite vendor labeling as an authenticated SQL injection, the endpoint requires no authentication or session validation and enables bulk collection of customer PII. No public exploit code has been identified at time of analysis; the vendor has resolved the issue by removing the server-side endpoint and migrating autofill to client-side localStorage.
CSRF in JoomShaper EasyStore for Joomla versions 1.0.0 through 3.0.0 allows an attacker to silently modify the core Joomla mail sender name and address (fromname, mailfrom) in configuration.php by tricking a logged-in administrator into visiting a malicious web page. The vulnerable endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration lacks anti-CSRF token validation and administrative authorization checks. Exploitation requires an authenticated admin session (UI:R) but no attacker credentials (PR:N); impact is limited to altering mail sender identity, and no public exploit was identified at time of analysis.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Unauthenticated order and payment forgery in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets remote attackers manipulate the payment and order state of arbitrary orders because critical fields such as order status and payment status are trusted from client-supplied input. An unauthenticated actor can mark unpaid orders as paid or otherwise tamper with order lifecycle states, undermining transaction integrity for any store using the extension. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 (high/critical) and network, no-auth, no-interaction vector make this a high-priority integrity flaw.
Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Cross-site request forgery (CSRF) in the EasyStore extension for Joomla (versions 1.0.0 through 3.0.0) allows a remote unauthenticated attacker to trick a logged-in victim into submitting unauthorized product reviews or review spam via the product.addReview endpoint. The flaw stems from commented-out anti-CSRF token verification, and exploitation requires the victim to visit attacker-controlled content while authenticated. No public exploit code or active exploitation has been identified at time of analysis, and the impact is limited to low integrity (unauthorized reviews) without confidentiality or availability loss.