CVE-2026-78000 in J2Store Extension
Summary
by MITRE • 09/03/2026
Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in J2Store versions 1.0.0 through 3.3.21 and 4.0.0 through 4.1.6 represents a critical security flaw rooted in improper validation of user-supplied input within the application's task handlers. Specifically, the parameters filter_tag, pricefrom, and priceto are susceptible to reflected Cross-Site Scripting when they accept base64-encoded URLs that are subsequently used for redirection without verifying the destination host. This architectural oversight allows an attacker to craft malicious links that appear to originate from the legitimate shop's trusted domain, thereby bypassing user trust mechanisms and browser security features designed to prevent phishing attacks. The absence of authentication requirements further exacerbates the risk, as any unauthenticated visitor can exploit this flaw by simply visiting a crafted URL or being tricked into clicking on one via social engineering tactics such as email campaigns or malicious websites.
From a technical perspective, the core issue lies in the application's failure to implement strict allow-listing of redirect destinations. When the task handlers process the base64-encoded input, they decode it and immediately initiate an HTTP redirect to the resulting URL. Because there is no mechanism to check whether the target host matches the expected domain or a predefined list of safe domains, the browser treats the malicious site as if it were part of the original application context. This behavior aligns with CWE-601, which describes Open Redirect vulnerabilities where an attacker can redirect users from a trusted website to an untrusted one. In this specific instance, the use of base64 encoding serves as an obfuscation technique that may bypass simple string-matching filters or naive validation logic implemented by developers who might only check for obvious malicious patterns rather than enforcing strict domain verification.
The operational impact of this vulnerability is significant due to its potential for facilitating sophisticated phishing campaigns. Attackers can host a replica of the login page, payment gateway, or any sensitive form on their own server and link it using the vulnerable J2Store URL parameters. When users click these links, they are redirected to the attacker's site while seeing the legitimate shop's domain in the browser address bar initially, creating a false sense of security. This can lead to credential theft, where victims unknowingly enter their usernames and passwords into the malicious form. Additionally, since J2Store is an e-commerce platform handling sensitive financial data, attackers could also attempt to capture credit card information or other personally identifiable information under the guise of completing a purchase. The reflected nature of the XSS component suggests that if additional script injection vectors exist within these parameters beyond just redirection, it could lead to session hijacking or defacement, although the primary described impact is phishing via open redirect.
To mitigate this vulnerability, developers and site administrators must implement strict validation for all user-supplied input used in redirects. The most effective defense is to maintain an allow-list of approved domains that are permitted as redirection targets. Any URL not matching a domain on this list should be rejected or redirected to a safe default page within the application itself. If dynamic redirect destinations are required, they must be validated against a comprehensive set of rules including protocol verification and host name checking using robust cryptographic hashing or strict string comparison methods rather than simple substring matches. For existing installations running vulnerable versions, upgrading to patched releases is essential if available from the vendor. In cases where immediate patching is not possible, web application firewalls can be configured to detect and block requests containing base64-encoded URLs in these specific parameters, although this is a less reliable long-term solution than fixing the underlying code logic. Regular security audits focusing on input validation and output encoding practices are recommended to prevent similar issues across other components of the Joomla extension ecosystem.