CVE-2026-102775 in Phoca Cart Extension
Summary
by MITRE • 10/05/2026
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order token) parameters are checked for non-emptiness only — they are never compared to the stored download_token / order_token values. As a result, any remote user (including a guest with no account at all) can download any customer's digital goods by enumerating sequential id values and supplying arbitrary non-empty tokens.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in Phoca Cart versions 5.0.0 through 6.1.8 represents a critical authorization bypass rooted in improper implementation of access control mechanisms within the application order view functionality. This flaw specifically affects the endpoint responsible for facilitating the download of digital goods associated with customer orders. The core technical deficiency lies in how the system validates authentication tokens required to initiate these downloads. Instead of performing a strict cryptographic or logical comparison between the provided parameters and the actual values stored securely on the server, the application performs only a superficial validation check. Specifically, the code verifies that the download token parameter d and the order token parameter o are not empty strings. This lenient approach fails to ensure that the tokens presented by the client actually correspond to valid, authorized sessions or orders belonging to the requesting user.
This architectural weakness effectively transforms the vulnerability into an Insecure Direct Object Reference scenario where sequential enumeration becomes a viable attack vector for remote exploitation. Because the system does not validate the integrity of the token against its internal state, any arbitrary non-empty string can be supplied as a valid credential in this context. An attacker with no prior authentication or user account on the Joomla platform can exploit this by systematically iterating through order identifiers and pairing them with dummy tokens that satisfy the empty-check condition. The application logic accepts these requests without verifying ownership, thereby granting unauthorized access to sensitive digital assets such as software licenses, e-books, or other proprietary files intended for specific paying customers only.
The operational impact of this vulnerability is severe, leading directly to a breach of confidentiality and potential intellectual property theft. Since the flaw allows any remote user to download any customer's digital goods, it undermines the fundamental business logic of paid content distribution. Attackers can harvest valuable data or proprietary software without detection by standard access logs that might only record successful authentication events rather than flawed authorization checks. This exposure not only results in direct financial loss for merchants but also damages their reputation and violates compliance requirements regarding customer data protection. The ability to enumerate resources further exacerbates the risk, as it allows adversaries to map out the scope of available digital goods and target high-value items selectively.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically highlighting failures in verifying user identity before granting access to specific objects or functions. It also maps closely to CWE-639 Authorization Bypass Through User-Controlled Key, as the attacker leverages predictable or arbitrary keys (tokens) that are not properly validated against server-side state. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078 Valid Accounts if the attacker were to use stolen credentials, but in its current unauthenticated form, it represents a broader exploitation path often categorized under unauthorized access patterns where identity verification is bypassed entirely due to weak input validation.
Mitigation strategies must focus on implementing robust server-side authorization checks that strictly compare provided tokens against their corresponding stored values using secure comparison methods resistant to timing attacks. Developers should ensure that every request for sensitive resources undergoes a rigorous authentication and authorization workflow, verifying not just the presence of credentials but their validity and association with the requesting user's session or order history. Additionally, implementing rate limiting on download endpoints can help mitigate enumeration attempts by detecting abnormal patterns of requests from single IP addresses. Upgrading to patched versions that correct this logic is essential for immediate remediation, alongside auditing other areas of the application for similar lax validation practices regarding sensitive parameters.