CVE-2026-90902: Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (arraymap('intval', ...)) and adopting parameterized ->whereIn() query construction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the coupon bulk update task, strictly cast all input IDs to integers using array_map('intval', ...) and use parameterized ->whereIn() query construction instead of concatenating IDs into raw SQL IN (...) clauses.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Joomla administrator. The vulnerable functionality is the Easy Store coupon bulk update task in the administrator interface.
Which Easy Store versions are affected?
Easy Store versions 1.0.0 through 3.0.0 are identified as affected.
What input is vulnerable?
The coupon bulk update task accepted coupon or product IDs that were concatenated directly into SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php. An administrator could supply SQL syntax through those ID values.
How was the issue fixed?
The fix casts all supplied IDs to integers with array_map('intval', ...) and replaces the raw SQL construction with parameterized ->whereIn() queries.