J2Commerce Com
Monthly
Missing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2StoreControllerApps` `appTask` delegation path - which instantiates app-plugin controllers with no ACL check - and drive `applocalizationdata::getInstallerTool()` with a caller-influenced, non-allow-listed table name to truncate `#__j2store_*` tables and construct a path-traversal-capable path to SQL files it then executes. This yields a file-read/execute primitive affecting J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. There is no public exploit identified at time of analysis, and access is currently blocked only as an accidental side effect of an `fof.xml` wildcard-deny rather than a deliberate control.
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers to any authenticated site user. The `editAddress()` function's ownership guard only fires when the address row carries a non-empty `user_id`; guest-checkout rows have a null `user_id`, silently bypassing the check. Any registered Joomla account can iterate sequential `address_id` integers to retrieve full name, street address, and phone number for all guest orders across J2Store versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. No public exploit has been identified at time of analysis, but the attack is trivially simple for any authenticated user.
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 allows any anonymous attacker to confirm orders without payment or force other customers' orders to FAILED status. The vulnerability stems from three compounding flaws: a signature verification function that treated UNVERIFIED as acceptable, disabled TLS peer verification on the outbound PayPal check, and amount validation that could be entirely bypassed by omitting the mc_gross field - making the IPN endpoint trivially forgeable with a plain unauthenticated HTTP POST. No public exploit has been identified at time of analysis, but the attack is trivially constructable from the description alone given enumerable order IDs and a merchant receiver_email that is typically public.
Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 release lines via an unoverridden inherited FOF framework `save` task reachable by unauthenticated front-end requests. The controller correctly restricted `remove()` to the caller's own session but never overrode the generic FOF `save` task, leaving it exposed to unauthenticated `format=raw` POST requests that can insert new cart rows with attacker-chosen `user_id`/`session_id` values or overwrite existing rows by numeric ID. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity network vector makes this trivially exploitable against any publicly reachable J2Store storefront.
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.
Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the `filter_tag`, `pricefrom`, and `priceto` parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables unauthenticated remote attackers to craft phishing URLs that abuse the trusted domain of a legitimate shop. Four cart controller task handlers decode a base64-encoded URL from user-supplied input and redirect without validating the destination hostname, allowing attackers to route victims to arbitrary external sites while the URL appears to originate from the merchant's real domain. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the unauthenticated network access path and low attack complexity make this straightforward to leverage in targeted phishing campaigns against shop customers.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing authorization in J2Store, the J2Commerce e-commerce extension for Joomla, lets remote attackers reach the `J2StoreControllerApps` `appTask` delegation path - which instantiates app-plugin controllers with no ACL check - and drive `applocalizationdata::getInstallerTool()` with a caller-influenced, non-allow-listed table name to truncate `#__j2store_*` tables and construct a path-traversal-capable path to SQL files it then executes. This yields a file-read/execute primitive affecting J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6. There is no public exploit identified at time of analysis, and access is currently blocked only as an accidental side effect of an `fof.xml` wildcard-deny rather than a deliberate control.
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers to any authenticated site user. The `editAddress()` function's ownership guard only fires when the address row carries a non-empty `user_id`; guest-checkout rows have a null `user_id`, silently bypassing the check. Any registered Joomla account can iterate sequential `address_id` integers to retrieve full name, street address, and phone number for all guest orders across J2Store versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. No public exploit has been identified at time of analysis, but the attack is trivially simple for any authenticated user.
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 allows any anonymous attacker to confirm orders without payment or force other customers' orders to FAILED status. The vulnerability stems from three compounding flaws: a signature verification function that treated UNVERIFIED as acceptable, disabled TLS peer verification on the outbound PayPal check, and amount validation that could be entirely bypassed by omitting the mc_gross field - making the IPN endpoint trivially forgeable with a plain unauthenticated HTTP POST. No public exploit has been identified at time of analysis, but the attack is trivially constructable from the description alone given enumerable order IDs and a merchant receiver_email that is typically public.
Cart-record tampering in J2Store (Joomla e-commerce extension by j2commerce.com) affects all versions across the 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 release lines via an unoverridden inherited FOF framework `save` task reachable by unauthenticated front-end requests. The controller correctly restricted `remove()` to the caller's own session but never overrode the generic FOF `save` task, leaving it exposed to unauthenticated `format=raw` POST requests that can insert new cart rows with attacker-chosen `user_id`/`session_id` values or overwrite existing rows by numeric ID. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity network vector makes this trivially exploitable against any publicly reachable J2Store storefront.
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.
Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the `filter_tag`, `pricefrom`, and `priceto` parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables unauthenticated remote attackers to craft phishing URLs that abuse the trusted domain of a legitimate shop. Four cart controller task handlers decode a base64-encoded URL from user-supplied input and redirect without validating the destination hostname, allowing attackers to route victims to arbitrary external sites while the URL appears to originate from the merchant's real domain. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the unauthenticated network access path and low attack complexity make this straightforward to leverage in targeted phishing campaigns against shop customers.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.