CVE-2026-102800: Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0
Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in moddjhelpfularticles/helper.php), reachable without authentication through comajax. The value was stored exactly as submitted instead of being taken from the connection by the server. It was then printed without output escaping in the administrator backend’s “Helpful articles” overview (views/items/tmpl/default.php). $db->quote() was applied on insert, which protects the SQL statement but does nothing for HTML output. There was no CSRF token, no rate limit, and the vote de-duplication keyed on the same attacker-controlled field.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Joomla sites using DJ-HelpfulArticles versions earlier than 1.3.0 are affected where the voting widget's AJAX handlers are reachable through com_ajax. Exploitation does not require a Joomla account.
What does an attacker need to do to trigger the stored XSS?
An attacker can submit a crafted value in the client-supplied ip field to the widget's getDeny, getConfirm, or getDenyReason AJAX handler. The payload is stored and executes when an administrator views the Helpful articles overview in the backend.
Are default protections sufficient to prevent exploitation?
No. The affected handlers have no CSRF token or rate limit, and vote de-duplication relies on the attacker-controlled ip field. SQL quoting on insertion does not prevent the later HTML output from executing as script.
What can be done before upgrading?
Restrict or disable public access to the affected voting widget and its com_ajax endpoints where operationally feasible. Limit administrator access to the Helpful articles overview until stored entries can be reviewed and removed.
How can administrators check for compromise?
Review records shown in the administrator Helpful articles overview for unexpected or HTML-like values in the stored IP-related voting data. Treat suspicious values as potentially executable content and remove them before opening the overview in a browser.