Vulnerabilities

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.1 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser (or an automated system that fetches it), causes the resulting redirect to `com_j2store`'s checkout controller to carry attacker-chosen query parameters instead of only the intended `view=checkout&task=confirmPayment&orderpayment_type=...&paction=process` set — parameter injection/smuggling into that follow-up request. This requires a victim to load the crafted link (`UI:R`/`UI:P`); it does not by itself grant an unauthenticated attacker anything they could not already obtain by requesting the target `com_j2store` URL directly with their own parameters.

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla `secret` can compute a valid access token for *any* order on the site without ever having placed one, gaining guest access to that order's details and any purchased digital downloads. Because the token is never rotated, this exposure persists indefinitely even after the underlying secret-disclosure vector is patched, unless the Joomla secret itself is also rotated. The attack complexity (`AC:H`) is high because it depends on the secret already being known through a separate vector; it is not directly exploitable by an anonymous visitor with no other foothold.

J2Store, a Joomla e-commerce extension from j2commerce.com, contains an unauthenticated flaw in its order-status handling: an attacker who can reach the storefront can send a crafted status-update request for any order without authenticating or supplying valid payment or transaction data. The impact is a denial of service against the order pipeline — pending orders can be mass-flipped to FAILED to disrupt revenue and force manual reprocessing, and already-fulfilled orders can be reverted to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The root cause maps to CWE-472 (trust of assumed-immutable web parameters) and CWE-602 (client-side/server-side enforcement mismatch) on the order-status update flow. Every released version is affected — 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7 — earning a CVSS 4.0 score of 8.7 (high), though with no integrity impact beyond order state. Exploitation status: no public PoC and no known in-the-wild attacks, but the flaw is trivially discoverable by anyone probing a Joomla store.

Do: Update J2Store to a release newer than the affected ranges — i.e., beyond 4.1.7 on the current line, or the latest available build for sites still on the 3.x/4.0.x branches — since all prior versions are vulnerable. Audit order history for unexplained FAILED transitions and reconcile order states against payment-gateway records before issuing any refunds or cancellations. Until patched, apply a WAF rule or rate limit to block and log unauthenticated requests hitting order-status update endpoints.

J2Store, a Joomla e-commerce extension from j2commerce.com, builds the on-disk path for purchased digital downloads in J2StoreModelOrderdownloads::getFilePath() by concatenating the configured attachment folder with the stored product_file_save_name, applying only JPath::clean() — which normalizes separators but does not reject ../ segments — and never verifying the resolved path stays inside the attachment folder. When a customer triggers a download via task=download for a product file whose saved name contains a ../ traversal sequence, the path resolves outside the attachment folder and the requester can download any file readable by the web server, such as configuration.php containing database credentials and the Joomla secret. The traversal string is most plausibly injected through the CSRF-forgeable admin product-file save actions, so an attacker needs no server compromise to plant it, and a valid token/pid pair can be obtained by simply purchasing the product. Affected deployments are Joomla sites running J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 that use the digital downloads feature. There is no public PoC, no known in-the-wild exploitation, and the CVE is not in CISA's KEV catalog.

Do: Upgrade J2Store to a build newer than the affected ranges (later than 3.3.2 on the 3.x branch, later than 4.0.22 on 4.0.x, or later than 4.1.7 on 4.1.x), which resolves and confines the download path to the attachment folder. Audit stored product_file_save_name values in the product-files table for ../ segments and review web server access logs for task=download requests containing traversal sequences. If configuration.php may have been read, rotate the database credentials and the Joomla secret and invalidate all active sessions.

J2Store, a widely used e-commerce extension for Joomla from j2commerce.com, contains an unauthenticated blind SQL injection flaw in the storefront product list, reachable on any public shop that exposes the standard product listing or product-tags filter. An attacker with no account can craft malicious filter/listing requests and use boolean- or time-based inference to slowly extract arbitrary database content, including customer records, order data, and stored credentials or tokens. All shops running J2Store versions 1.0.0-3.3.2, 4.0.0-4.0.22, or 4.1.0-4.1.7 are affected because the vulnerable endpoint sits on the public-facing storefront, requiring no authentication or user interaction. The issue is rated high severity (CVSS 4.0: 8.7) with high impact on confidentiality of the shop database. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported as of this analysis.

Do: Upgrade J2Store immediately to a release outside the affected ranges (later than 4.1.7, or a patched build of your current branch). Until patched, apply WAF rules that filter SQL metacharacters on the product-list and product-tags filter parameters, and verify that the database account used by Joomla has least-privilege access. Review web server and database logs for anomalous, repetitive or slow-responding requests to storefront product listing/filter URLs as signs of blind SQL injection probing, and rotate any credentials, tokens, or secrets stored in the database if compromise is suspected.

J2Store, a Joomla e-commerce extension from j2commerce.com, ships its cart, checkout, and myprofile controllers without CSRF token checks, so a forged cross-site request can ride a victim's active session and silently overwrite the billing or shipping address before order confirmation — potentially redirecting a paid order's goods to an attacker-controlled address — or tamper with a saved profile address via saveAddress(). The attack requires user interaction (the victim must encounter attacker-controlled content while logged in), but needs no privileges and executes with the victim's own session rights, so there is no cross-account data access. The flaw is rated high severity (CVSS 4.0: 7.1, primarily an integrity impact). Every release of the product is affected: 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7. No public proof of concept exists and no in-the-wild exploitation has been observed.

Do: Upgrade every J2Store installation to the latest available release, which is newer than the affected ranges (beyond 4.1.7, 4.0.22, and 3.3.2 respectively). As an interim mitigation, enforce SameSite=Lax or Strict on session cookies (the 'cookie_samesite' setting on Joomla 4+) to blunt cross-site forgeries, and review recent orders for shipping or billing address changes made late in checkout that differ from the customer's saved profile.