CVE-2026-90900 in Easy Store Extension
Summary
by MITRE • 09/23/2026
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified within the Easy Store extension for Joomla versions 1.0.0 through 3.0.0 represents a critical failure in implementing secure state change operations via Cross-Site Request Forgery protections. Specifically, the endpoint responsible for submitting product reviews, located at index.php?option=com_easystore&task=product.addReview, was found to accept POST requests without validating an anti-CSRF token. This deficiency stems from code modifications where the necessary security checks were commented out during development or maintenance phases, leaving the application vulnerable to unauthorized state changes initiated by malicious actors. The absence of this verification mechanism allows any authenticated user session to be hijacked for performing actions that require higher privileges than those available to unauthenticated visitors, fundamentally undermining the integrity of the storefront's interactive features.
From a technical perspective, the flaw is classified under CWE-352, which denotes Cross-Site Request Forgery (CSRF). The application failed to implement standard countermeasures such as synchronizer tokens or double-submit cookies that are essential for distinguishing between legitimate user-initiated requests and maliciously crafted ones. In Joomla's architecture, session management relies heavily on token validation to ensure that form submissions originate from the intended page context. By omitting this check in the ProductController class handling review submissions, the application effectively trusts any POST request directed at the addReview task regardless of its origin. This allows an attacker to construct a malicious webpage containing a hidden form or JavaScript-driven AJAX call that automatically submits reviews on behalf of a logged-in administrator or store owner who visits the attacker's site while their Joomla session is still active in the browser.
The operational impact of this vulnerability extends beyond simple spamming, although review flooding was cited as a primary concern. An attacker could manipulate product ratings by submitting fake positive or negative reviews without the knowledge or consent of legitimate users. This can severely damage the reputation of products and the store itself, leading to loss of customer trust and potential financial harm. Furthermore, if the application logic permits more sensitive actions through similar endpoints with weaker validation, the scope of impact could expand to include data integrity issues where false information is permanently stored in the database. The ability to inject arbitrary content via reviews also introduces secondary risks such as Cross-Site Scripting (XSS) if input sanitization on review text is insufficient, although the primary vector here remains CSRF.
Mitigation strategies for this vulnerability involve restoring and enforcing strict session token validation within the Joomla framework's security model. Developers must ensure that Session::checkToken('request') or Session::checkToken('post') is actively called in the ProductController before processing any review submission data. On the frontend, it is imperative to inject HTMLHelper::_('form.token') into the review form template so that a valid token is generated and included with every request. Additionally, client-side scripts like review-form.js must be updated to automatically append this session token to the payload sent during AJAX submissions or standard form posts. This ensures that each state-changing operation carries proof of its origin from a legitimate page served by the application itself.
In terms of industry standards mapping, this vulnerability aligns with MITRE ATT&CK technique T1566.002, which covers Spearphishing Link attacks used to deliver CSRF payloads via social engineering. The attacker typically lures an authenticated user into clicking a link or loading a page that triggers the malicious request in the background. To prevent such attacks, organizations should adopt defense-in-depth strategies including implementing SameSite cookie attributes to restrict how browsers send cookies with cross-site requests, utilizing Content Security Policy headers to limit script execution contexts, and conducting regular code audits focused on state-changing operations. Ensuring that all forms utilize unique, unpredictable tokens tied to the user's session is a fundamental requirement for maintaining web application security integrity in Joomla-based ecosystems.