CriticalPublic exploit

Unauthenticated SQL Injection in JoomShaper Easy Store

IdentifiersCVE-2026-65761CWE-89· Improper Neutralization of Special…

CVE-2026-65761 is an unauthenticated SQL injection vulnerability in JoomShaper Easy Store for Joomla versions 1.0.0 through 2.0.1. Improper validation of order parameters allows attacker-controlled SQL syntax to influence database queries without requiring authentication.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

A remote unauthenticated attacker can obtain full read access to the Easy Store/Joomla database. Exposed information may include application credentials and session data, enabling account compromise or further unauthorized access.

Mitigation

If you can’t patch tonight, do this now.

Until a fixed version is deployed, reduce exposure by restricting public access to the affected Joomla instance where feasible, placing the application behind access controls or a WAF capable of detecting and blocking SQL injection patterns, and closely monitoring for anomalous requests targeting Easy Store order-related parameters. As a precaution, rotate potentially exposed credentials and invalidate active sessions if compromise is suspected.

Remediation

Patch, then assume compromise.

Upgrade or patch Easy Store to a vendor-fixed version newer than 2.0.1 when available.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

CVE-2026-65761MaturityOperationalVerified exploit

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-65761, an unauthenticated SQL injection in JoomShaper EasyStore for Joomla <= 2.0.1. The repo contains four files: a README with vulnerability background and usage, a single executable Python script, a minimal requirements file noting stdlib-only usage, and .gitignore. The main exploit file, cve_2026_65761.py, uses urllib with TLS verification disabled and a browser-like User-Agent to send GET requests to the Joomla front-end endpoint /index.php with option=com_easystore, view=products, and a malicious filter_sortby parameter. The exploit abuses the fact that the sort column must be allow-listed but the sort direction is concatenated into ORDER BY without ASC/DESC validation. Operationally, the script first confirms the issue using a time-based payload with SLEEP(5), then implements a blind boolean oracle using IF(condition,SLEEP(2),0). On top of that oracle it builds extraction helpers for string length and character-by-character recovery via binary search. These helpers are used to fingerprint the DBMS (version, current database, current DB user), infer the Joomla table prefix from information_schema, dump rows from the Joomla users table, and extract sensitive configuration from the extensions table, including the Joomla secret and EasyStore payment-related settings such as paypal_email and Stripe keys if present. The exploit is not merely a detector because it includes full data-extraction logic. It is standalone rather than part of a larger exploit framework, and its maturity is best classified as OPERATIONAL because it contains a working hardcoded payload and automated extraction workflow but not a generalized framework module.

shinthinkDisclosed Jul 24, 2026pythonmarkdownweb

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

JoomShaperEasy Storeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cvefeed high severityNews

Jul 23, 2026

CVE-2026-65761 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

An unauthenticated SQL injection vulnerability in the Easy Store extension for Joomla caused by improper validation of order parameters, allowing full database read access including credentials and sessions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2