CVE-2026-90901

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-90901
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.
CVSS

No CVSS.

References
Link Resource
https://www.joomshaper.com/easystore
Configurations

No configuration.

History

25 Sep 2026, 18:17

Type Values Removed Values Added
CWE CWE-74 CWE-89
Summary (en) Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent. (en) Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.

23 Sep 2026, 19:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-23 19:19

Updated : 2026-09-25 18:17

NVD link : CVE-2026-90901

Mitre link : CVE-2026-90901

CVE.ORG link : CVE-2026-90901

JSON object : View

Products Affected

No product.

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')