CVE-2026-105605 in DJ-Classifieds Extension
Summary
by MITRE • 11/02/2026
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in DJ-Classifieds versions prior to 3.11.3 represents a critical failure in access control mechanisms within the Joomla extension ecosystem. This flaw is classified as an Insecure Direct Object Reference, commonly known by its CWE identifier CWE-639. The core of the issue lies in the implementation of the duplicate advertisement feature located at site/models/additem.php. When a user initiates this convenience function to pre-fill a new listing with data from an existing one, the application retrieves the source advert using only its raw numeric primary key ID provided by the client-side request. Crucially, the backend logic fails to validate whether the requesting authenticated user is the legitimate owner of that specific advertisement ID. This lack of ownership verification allows any logged-in user to manipulate the object reference and access data belonging to other users or system entities they have no authorization to view.
The operational impact of this vulnerability extends beyond simple privacy violations, as it facilitates unauthorized cross-account ad access with significant sensitivity. Because the application does not check if the target advert belongs to the requester, nor does it verify the publication status of the ad, an attacker can retrieve full details for advertisements that are merely drafts, pending approval, or completely unpublished. This means sensitive information such as seller phone numbers, physical addresses, email contacts, and pricing data is exposed regardless of whether the listing was ever intended to be public-facing. The sequential nature of advert IDs further exacerbates this risk by allowing attackers to easily enumerate valid identifiers through simple incremental requests, turning a single logic flaw into a scalable data exfiltration vector against multiple victims simultaneously.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK technique T1078, specifically the Valid Accounts sub-technique where an attacker uses legitimate credentials to access resources they are not authorized for. It also reflects aspects of T1530, Data from Local System, as it involves reading data stored on the application server that is restricted by design but accessible due to poor implementation controls. The severity is heightened because authentication is required, which might lead administrators to assume a higher level of security than actually exists in this specific module. Attackers can leverage this flaw for social engineering purposes, gathering personal identifiable information from competitors or unsuspecting users without triggering typical intrusion detection alerts associated with unauthenticated scanning.
Mitigation strategies must prioritize immediate patching by upgrading DJ-Classifieds to version 3.11.3 or later where these access control checks have been implemented. In the interim, administrators should enforce strict input validation on all server-side endpoints handling object references, ensuring that every request for a resource is cross-referenced against an authorized user mapping table in the database. Implementing indirect reference maps, such as UUIDs instead of sequential integers, can also reduce the ease of enumeration but does not replace the need for explicit authorization checks. Furthermore, applying principle of least privilege to application roles and auditing server logs for unusual patterns of ID iteration can help detect ongoing exploitation attempts before significant data loss occurs.