CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.
Explanation of Vulnerability in Simple Terms
The Easy Store extension for Joomla contains a SQL injection vulnerability in versions 1.0.0 through 2.0.1. An attacker can inject malicious SQL commands through unfiltered input, potentially reading or modifying the site database. No authentication is required to exploit this vulnerability. Sites running affected versions should update immediately.
What an attacker can do
Read, modify, or delete data from the site database without authentication.
Potential impact on your site
Attackers can steal customer data, modify product listings, or take the store offline.
Conditions required to exploit
Network access to the site; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
