CVE-2026-90902 in Easy Store Extension
Summary
by MITRE • 09/23/2026
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (array_map('intval', ...)) and adopting parameterized ->whereIn() query construction.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in the Easy Store extension for Joomla, specifically within versions 1.0.0 through 3.0.0, represents a critical authenticated SQL injection flaw located in the coupon bulk update functionality. This component is accessible via the administrative interface at the endpoint administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The core technical defect stems from improper input validation and sanitization practices when processing user-supplied data. Specifically, the application accepts an array of identifier values intended to specify which coupons should be updated in bulk operations. Instead of employing secure database interaction patterns such as parameterized queries or strict type casting, the developers directly concatenated these raw inputs into SQL IN clauses within the ProductCoupon.php and CouponsModel.php files. This architectural oversight allows any authenticated administrator with access to this administrative feature to inject arbitrary SQL syntax into the query structure.
From a technical perspective, the vulnerability is classified under CWE-89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The attacker leverages their existing authentication privileges to manipulate the database backend by injecting malicious code fragments that alter the intended logic of the bulk update operation. Because the input IDs are not validated against expected integer formats before being embedded into the query string, it becomes possible for a malicious actor to close the current clause and append additional SQL statements. This could potentially lead to unauthorized data retrieval, modification, or deletion within the Joomla database schema. The severity is heightened by the fact that while authentication is required, administrative accounts often possess broad permissions, thereby increasing the potential blast radius of such an exploitation attempt.
The operational impact of this vulnerability extends beyond simple data corruption. An attacker with administrator access could exploit this flaw to exfiltrate sensitive information stored in other tables within the Joomla database, including user credentials, configuration settings, or customer personal data if accessible through joined queries. Furthermore, depending on the underlying Database Management System and its specific configurations, such as MySQL's ability to execute multiple statements separated by semicolons, an attacker might achieve remote code execution or complete system compromise. This aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, particularly when considering how SQL injection can be used to interact with the operating system via database extensions like xp_cmdshell in Microsoft SQL Server or similar features in MySQL. Even without direct OS access, the ability to read arbitrary data constitutes a severe breach of confidentiality and integrity principles defined by industry standards such as ISO/IEC 27001.
Mitigation strategies for this vulnerability focus on enforcing strict input validation and adopting secure coding practices for database interactions. The resolution implemented in later versions involves strictly casting all incoming ID values to integers using functions like array_map with intval, ensuring that only numeric data is processed by the database engine. Additionally, transitioning from raw SQL string concatenation to parameterized query methods such as ->whereIn() provided by Joomla's database abstraction layer prevents injection attacks by separating code from data. Administrators running affected versions should immediately update the Easy Store extension to a patched version where these safeguards are in place. In environments where updating is not immediately feasible, implementing Web Application Firewall rules that detect SQL injection patterns in POST requests targeting this specific endpoint can provide temporary protection against exploitation attempts while maintaining operational continuity.