Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability affects an e-commerce extension for Joomla websites, specifically how it handles product attribute filtering. It allows an unauthenticated attacker to potentially extract sensitive data from the website's database. The primary concern is to confirm if this specific extension is in use and whether it is exposed to the internet.
- Unauthenticated attackers can inject database commands.
- Impacts systems with a public-facing product catalog.
- Confirm usage and internet exposure of the extension.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests to the public shop items page. The attacker targets the `a[]` and `s[]` GET parameters, which are directly included in SQL queries without proper sanitization. This allows the attacker to inject malicious SQL code, potentially leading to unauthorized access and extraction of sensitive database information.
- No authentication required.
- Inject SQL via GET parameters.
- Database compromise and data theft.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could impact database integrity and expose sensitive information when users interact with the public shop items page of the Phoca Cart extension. Specifically, the "attribute" and "specification" GET parameters are processed without proper sanitization, allowing an unauthenticated attacker to inject malicious SQL commands. This could lead to the extraction of all data from the site's database.
- Full database extraction.
- Via unauthenticated SQL injection.
- Compromise of all site data.
Operational Fix
Recommended remediation, mitigation, and detection steps
The Joomla extension Phoca Cart, specifically its public shop items page, is vulnerable to unauthenticated SQL injection. This allows unauthenticated attackers to extract full database information by injecting malicious SQL through the `a[]` and `s[]` GET parameters. Owners of Joomla sites utilizing this extension should prioritize identifying affected instances, assessing their exposure and business criticality, and coordinating with the vendor for remediation.
- Application owners should own this issue.
- Verify public reachability and business criticality.
- Plan remediation with vendor coordination.
