ywh-jfellus/cve-2026-65761Proof of Concept for CVE-2026-65761 - EasyStore Pro Unauthenticated SQL Injection via `filter_sortby`
filter_sortby proof-of-conceptThis repository provides an educational proof of concept for CVE-2026-65761, an unauthenticated SQL injection vulnerability affecting versions 1.0.0 through 2.0.2 (inclusive) of the EasyStore Joomla extension. Only the Pro version of the plugin is affected, since the filter_sortby parameter is license-gated.
The PoC (poc.py) demonstrates SQL injection in the filter_sortby request parameter on the products search flow (option=com_easystore&view=products&task=search) via an error-based check.
This project and the Docker stacks are for local security testing and education only.
Do not run this against systems you do not own or explicitly have permission to test.
The vulnerable code path is in a Pro-only feature. To make the code path auditable in a reproducible local lab, this repository applies a so the Pro-gated sort/filter path can be exercised.
This is not provided as a licensing bypass technique and must not be used to access paid features in real deployments. Its sole purpose is to enable defensive security research and coordinated vulnerability validation on an isolated local test environment.
.
├── backup.sql.gz
├── poc.py
├── vulnerable/
│ ├── docker-compose.yaml
│ └── setup.sh
└── patched/
├── docker-compose.yaml
└── setup.sh
poc.py: exploit PoC.vulnerable/docker-compose.yaml: vulnerable lab stack on http://127.0.0.1:9999.patched/docker-compose.yaml: patched lab stack on http://127.0.0.1:9999.backup.sql.gz: bootstrap dump with a minimal EasyStore shop dataset required by this PoC (2 products, 1 category, basic shop settings).vulnerable/setup.sh and patched/setup.sh: import backup.sql.gz into the running MariaDB container.pip install requests
Start the vulnerable environment:
docker compose -f vulnerable/docker-compose.yaml up -d
Then provision the required EasyStore test data:
cd vulnerable
./setup.sh
cd ..
Run the PoC:
python3 poc.py
Expected vulnerable result includes:
[!] Target is vulnerable to CVE-2026-65761!
Stop the vulnerable stack first (if running):
docker compose -f vulnerable/docker-compose.yaml down -v
Start the patched environment:
docker compose -f patched/docker-compose.yaml up -d
Then provision the same required EasyStore test data:
cd patched
./setup.sh
cd ..
Run the same PoC:
python3 poc.py
Expected patched result is:
[-] Target is not vulnerable to CVE-2026-65761
In poc.py, target URL defaults to http://localhost:9999.
Adjust it if you run the lab on a different host or port.