CVE-2026-74251: Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.16
Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.16 - The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74251?
CVE-2026-74251 has a risk score of 80, indicating a high severity level.
How do I fix CVE-2026-74251?
To fix CVE-2026-74251, update Phoca Cart to a version that addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2026-74251?
CVE-2026-74251 is classified as an Unauthenticated SQL Injection vulnerability.
Which versions of Phoca Cart are affected by CVE-2026-74251?
CVE-2026-74251 affects Phoca Cart versions 5.0.0 to 6.1.16.
Can CVE-2026-74251 be exploited remotely?
Yes, CVE-2026-74251 can be exploited remotely due to the lack of authentication requirements.