Seven Joomla extension flaws, and one of them was handing out customer invoices

Two JoomShaper extensions, seven vulnerabilities, seven CVEs, all of them ours. In EasyStore, the Joomla shop component, any logged-in customer could read every other customer's order and printable invoice by changing one number in the URL: name, email, billing and shipping address, phone number, purchase history. On a shop with open registration, that means anyone who signs up. Two more issues in the same component needed no login at all. And today, SP Page Builder 6.7.1 closes four more we reported, including a pre-authentication SQL injection and an open mail relay that could send spoofed email from your own domain.

That is the loud half of the last three weeks. Gridbox belongs in it too: Balbooa's page builder took a value straight from the visitor's own browser as proof of who they were, so setting one cookie to an administrator's username logged you in as a Super User, with no password and no login form. Fixed in 2.20.1. The quieter half: Membership Pro fixed anonymous file uploads without saying so, Events Booking accepted uploads from anyone by default and leaked every user's name and email, and two more Joomla extension flaws went public through the CNA that were not ours at all. Good. It should never have been just us looking. If you want the whole picture, we counted nineteen disclosures in a month, and it has kept climbing since.

Look at what most of these actually handed over. EasyStore, SP Page Builder and Quix were all unauthenticated SQL injection, which means an anonymous request could read every table you have: Joomla accounts, password hashes, the site secret, customer records, the whole lot, downloaded by anyone who asked. Gridbox reached the same place by a different road, because a Super User can edit templates and templates run PHP. And a database read leaves nothing behind: no changed files, no new admin user, nothing for an integrity scanner to catch. If any of these ran on your sites in a vulnerable version, work on the assumption that the database has already been copied. Rotate the Joomla secret and any stored API keys, and treat every password hash as known.

All posts are free to read on the blog

Critical

EasyStore – every customer's invoice was one URL edit away

The order and invoice views checked that somebody was logged in, never that the order was theirs. Change the id in the URL and you had another customer's name, email, billing and shipping address, phone number and full purchase history. Two more flaws sat alongside it and needed no login: an anonymous request could mark any order paid without ever contacting a payment gateway, and the product sort parameter went straight into the database query, exposing every table. JoomShaper fixed all three in 2.0.2 the day after we reported them, then shipped it with no advisory and no credit, the three security lines buried under a coupon bug and a thumbnail glitch. The Joomla CNA assigned three CVEs and rated two of them Critical.

Patched today

SP Page Builder – a pre-auth SQL injection and an open mail relay

The Dynamic Content endpoint pasted a request value straight onto the end of the query's sort clause. The only guard in front of it was a CSRF token, and Joomla hands one of those to every anonymous visitor, so in practice an attacker could read any table in your database, password hashes included. The mail relay is the one that surprised us: the contact-form addons signed the recipient address with a secret hardcoded identically into every copy of the extension. A secret that ships inside the product is not a secret, so anyone could forge it and make your site send email to any address, with a spoofed sender, from your domain and your mail server. Four CVEs, all closed in 6.7.1.

New tool

One Vulnerable Extension List for Joomla and WordPress

The Joomla VEL stops at the Joomla border, and for the WordPress half of your sites you are watching a completely separate set of feeds. Both share a bigger limitation than the effort of following them: neither knows which sites you run. They can tell you a piece of software is vulnerable somewhere in the world, but not that your client's site is exposed right now. The new Latest Vulnerabilities page inside mySites.guru is one list covering both platforms, with a severity, a CVE where one exists and an affected version range on every row, wired into the sites already in your account. It comes with your subscription and it is live now.

The rest of the last three weeks

Need help with your site? Phil Taylor – Fixing websites since 2004

Found something wrong with your Joomla or WordPress site? If it were simple, you'd have fixed it already. I offer same-day expert help at a flat rate of £120 per incident. No hourly billing surprises.

If I can't add value, you don't pay