CVE-2026-74251: Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - phoca.cz - Phoca Cartto a version that resolves this vulnerability.Fixed in 5.0.0-6.1.6Patch Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - Compensating control
Restrict access to the Phoca Cart public shop items page/endpoint parameters a[] (attribute) and s[] (specification) from untrusted networks (e.g., via firewall/ACL/WAF) until the vulnerable version is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74251?
CVE-2026-74251 has a risk score of 80, indicating a high severity level.
How do I fix CVE-2026-74251?
To fix CVE-2026-74251, update Phoca Cart to a version that addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2026-74251?
CVE-2026-74251 is classified as an Unauthenticated SQL Injection vulnerability.
Which versions of Phoca Cart are affected by CVE-2026-74251?
CVE-2026-74251 affects Phoca Cart versions 5.0.0 to 6.1.16.
Can CVE-2026-74251 be exploited remotely?
Yes, CVE-2026-74251 can be exploited remotely due to the lack of authentication requirements.