Phoca Cart Extension For Joomla
Monthly
Unauthenticated remote attackers can download any customer's purchased digital goods from Joomla sites running the Phoca Cart extension (versions 5.0.0 through 6.1.8), because the order-file download endpoint checks only that the 'd' (download token) and 'o' (order token) parameters are non-empty instead of comparing them with the stored download_token and order_token values. Any guest with no account can enumerate sequential numeric order IDs, supply arbitrary non-empty token values, and retrieve files belonging to other customers, making this a high-severity confidentiality breach with no authentication and no user interaction required (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5, C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the issue is a genuine high-priority concern rather than an inflated score, with impact limited only by the practical prerequisite that the store actually offers downloadable goods served through this endpoint and has existing order records to enumerate.
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated remote attackers can download any customer's purchased digital goods from Joomla sites running the Phoca Cart extension (versions 5.0.0 through 6.1.8), because the order-file download endpoint checks only that the 'd' (download token) and 'o' (order token) parameters are non-empty instead of comparing them with the stored download_token and order_token values. Any guest with no account can enumerate sequential numeric order IDs, supply arbitrary non-empty token values, and retrieve files belonging to other customers, making this a high-severity confidentiality breach with no authentication and no user interaction required (CVSS 4.0 base 8.7; assessed CVSS 3.1 7.5, C:H/I:N/A:N). No public exploit code was identified at time of analysis, and the issue is a genuine high-priority concern rather than an inflated score, with impact limited only by the practical prerequisite that the store actually offers downloadable goods served through this endpoint and has existing order records to enumerate.
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.