Easy Store extension for Joomla vulnerabilities
9 known vulnerabilities in Easy Store extension for Joomla from Joomshaper.com. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
Easy Store extension for Joomla: Improper Access Control
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configu
- 8.6 High severity
Easy Store extension for Joomla: Improper Access Control
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level AC
- 7.2 High severity
Easy Store extension for Joomla: Cross-Site Request Forgery
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative
- 8.6 High severity
Easy Store extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and d
- 8.6 High severity
Easy Store extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter
- 8.2 High severity
Easy Store extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server ret
- 9.3 Critical severity
Easy Store extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessio
- 9.2 Critical severity
Easy Store extension for Joomla: Exposure of Sensitive Information to an Unauthorized Actor
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.
- 8.7 High severity
Easy Store extension for Joomla: Improper Access Control
Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate pay