Exploit for CVE-2026-65761

## https://sploitus.com/exploit?id=B66082A8-54CD-58FD-B6C1-F7174CBBBEF0
# CVE-2026-65761 - EasyStore Pro SQL Injection via `filter_sortby` proof-of-concept

This repository provides an educational proof of concept for [CVE-2026-65761](https://vulners.com/cve/CVE-2026-65761), an unauthenticated SQL injection vulnerability affecting versions 1.0.0 through 2.0.2 (inclusive) of the EasyStore Joomla extension. Only the Pro version of the plugin is affected, since the `filter_sortby` parameter is license-gated.

The PoC (`poc.py`) demonstrates SQL injection in the `filter_sortby` request parameter on the products search flow (`option=com_easystore&view=products&task=search`) via an error-based check. 

## Disclaimer

This project and the Docker stacks are for **local security testing and education only**.  
Do not run this against systems you do not own or explicitly have permission to test.

The vulnerable code path is in a **Pro-only feature**. To make the code path auditable in a reproducible local lab, this repository applies a **temporary monkeypatch in the container** so the Pro-gated sort/filter path can be exercised.

This is **not** provided as a licensing bypass technique and **must not** be used to access paid features in real deployments. Its sole purpose is to enable defensive security research and coordinated vulnerability validation on an isolated local test environment.


## Repository Layout

```text
.
├── backup.sql.gz
├── poc.py
├── vulnerable/
│   ├── docker-compose.yaml
│   └── setup.sh
└── patched/
    ├── docker-compose.yaml
    └── setup.sh
```

- `poc.py`: exploit PoC.
- `vulnerable/docker-compose.yaml`: vulnerable lab stack on `http://127.0.0.1:9999`.
- `patched/docker-compose.yaml`: patched lab stack on `http://127.0.0.1:9999`.
- `backup.sql.gz`: bootstrap dump with a minimal EasyStore shop dataset required by this PoC (2 products, 1 category, basic shop settings).
- `vulnerable/setup.sh` and `patched/setup.sh`: import `backup.sql.gz` into the running MariaDB container.


## Prerequisites

- Docker + Docker Compose
- Python 3.8+
- Python package:

```bash
pip install requests
```

## Run the Vulnerable Lab Stack

Start the vulnerable environment:

```bash
docker compose -f vulnerable/docker-compose.yaml up -d
```

Then provision the required EasyStore test data:

```bash
cd vulnerable
./setup.sh
cd ..
```

Run the PoC:

```bash
python3 poc.py
```

Expected vulnerable result includes:

```text
[!] Target is vulnerable to CVE-2026-65761!
```

## Run the Patched Lab Stack

Stop the vulnerable stack first (if running):

```bash
docker compose -f vulnerable/docker-compose.yaml down -v
```

Start the patched environment:

```bash
docker compose -f patched/docker-compose.yaml up -d
```

Then provision the same required EasyStore test data:

```bash
cd patched
./setup.sh
cd ..
```

Run the same PoC:

```bash
python3 poc.py
```

Expected patched result is:

```text
[-] Target is not vulnerable to CVE-2026-65761
```

## PoC Configuration

In `poc.py`, target URL defaults to `http://localhost:9999`.

Adjust it if you run the lab on a different host or port.

## References

- https://vulners.com/cve/CVE-2026-65761
- https://www.joomshaper.com/easystore
- https://mysites.guru/blog/easystore-security-disclosure/