J2Store Extension For Joomla
Monthly
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables unauthenticated remote attackers to craft phishing URLs that abuse the trusted domain of a legitimate shop. Four cart controller task handlers decode a base64-encoded URL from user-supplied input and redirect without validating the destination hostname, allowing attackers to route victims to arbitrary external sites while the URL appears to originate from the merchant's real domain. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the unauthenticated network access path and low attack complexity make this straightforward to leverage in targeted phishing campaigns against shop customers.
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated file upload in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 permits any remote visitor to POST arbitrary files to the upload endpoint without authentication or CSRF validation. A compounding installer manifest defect omits .htaccess and web.config protection for the upload and invoices directories on fresh installs, making uploaded files directly web-accessible over HTTP. The provided CVSS 4.0 vector includes E:A (Exploit Maturity: Attacked), indicating active exploitation is confirmed at the scoring level, though no corresponding CISA KEV entry was present in the supplied intelligence data.
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Open redirect in the J2Store Joomla e-commerce extension (versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) enables unauthenticated remote attackers to craft phishing URLs that abuse the trusted domain of a legitimate shop. Four cart controller task handlers decode a base64-encoded URL from user-supplied input and redirect without validating the destination hostname, allowing attackers to route victims to arbitrary external sites while the URL appears to originate from the merchant's real domain. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the unauthenticated network access path and low attack complexity make this straightforward to leverage in targeted phishing campaigns against shop customers.
Order content disclosure in J2Store (Joomla e-commerce extension by j2commerce.com) versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5 allows any unauthenticated visitor to read the full checkout confirmation of arbitrary orders - including line items, prices, and totals - by supplying a controlled order_id query parameter, with no authentication required. This is a textbook CWE-639 Insecure Direct Object Reference flaw: the application fails to verify that the requesting party owns or is authorized to view the referenced order record. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivially low exploitation barrier (unauthenticated, network-accessible, likely sequential order IDs) makes this a high-priority remediation target for any J2Store deployment handling customer order data.
Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.