Loading vulnerability…
CVE-2026-74251 is an unauthenticated SQL injection vulnerability in the Phoca Cart extension for Joomla affecting versions 5.0.0 through 6.1.6. The flaw is present on the public shop items page, where the a[] attribute filter parameter and the s[] specification filter parameter supplied via HTTP GET are concatenated directly into SQL WHERE clauses without parameterization or escaping. This unsafe query construction allows remote attackers to inject arbitrary SQL into backend database queries. The issue is exploitable without authentication and supports time-based blind SQL injection, making it possible to enumerate and extract database contents even when query results are not directly returned to the client.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a small, focused proof-of-concept exploit for an unauthenticated time-based blind SQL injection in Phoca Cart, documented as CVE-2026-74251. Structure is minimal: a README with vulnerability analysis, exploitation steps, and impact discussion, plus a single Python script implementing automated extraction. The exploit is not part of a major framework. The Python script exploit.py is the operational component. It targets the public Joomla endpoint /index.php?option=com_phocacart&view=items and injects SQL through the a[color] GET parameter. The blind() function builds a payload using CASE WHEN (...) THEN SLEEP(3) ELSE 0 END and measures response time to determine whether a condition is true. The extract() function first infers the length of a query result, then brute-forces each printable ASCII character using ASCII(SUBSTRING(... FROM pos FOR 1)) comparisons. The hardcoded target query is SELECT password FROM jos_users ORDER BY id LIMIT 1, so the script’s immediate purpose is to dump the first Joomla user password hash. The README provides the vulnerability context: Phoca Cart’s attribute/specification filters a[] and s[] are allegedly concatenated into SQL without proper escaping in getSqlPartsArray() within admin/libraries/phocacart/search/search.php. It explains that the exploit relies on a comma-free payload format because the vulnerable code splits input on commas before constructing SQL. It also notes that the underlying query path is executed twice per request, amplifying timing differences. Main exploit capability: unauthenticated extraction of database content via time-based blind SQLi, with the included automation focused on credential hash theft. Secondary documented capability in the README includes potential broader database disclosure and possible write operations under favorable DB settings, though the provided code only performs read-oriented blind extraction. Overall, this is a concise operational PoC for web-based SQL injection against vulnerable Phoca Cart deployments.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.