Loading vulnerability…
CVE-2026-74251 is an unauthenticated SQL injection vulnerability in the Phoca Cart extension for Joomla affecting versions 5.0.0 through 6.1.6. The flaw is present on the public shop items page, where the a[] attribute filter parameter and the s[] specification filter parameter are incorporated directly into SQL WHERE clauses without parameterization or escaping. Because attacker-controlled input is concatenated into backend queries, a remote attacker can supply crafted values that alter SQL logic. The issue is exploitable without authentication and supports arbitrary SQL injection, including time-based blind techniques suitable for extracting database contents.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a small, focused proof-of-concept exploit for an unauthenticated time-based blind SQL injection in Phoca Cart, documented as CVE-2026-74251. Structure is minimal: a README with vulnerability analysis, exploitation steps, and impact discussion, plus a single Python script implementing automated extraction. The exploit is not part of a major framework. The Python script exploit.py is the operational component. It targets the public Joomla endpoint /index.php?option=com_phocacart&view=items and injects SQL through the a[color] GET parameter. The blind() function builds a payload using CASE WHEN (...) THEN SLEEP(3) ELSE 0 END and measures response time to determine whether a condition is true. The extract() function first infers the length of a query result, then brute-forces each printable ASCII character using ASCII(SUBSTRING(... FROM pos FOR 1)) comparisons. The hardcoded target query is SELECT password FROM jos_users ORDER BY id LIMIT 1, so the script’s immediate purpose is to dump the first Joomla user password hash. The README provides the vulnerability context: Phoca Cart’s attribute/specification filters a[] and s[] are allegedly concatenated into SQL without proper escaping in getSqlPartsArray() within admin/libraries/phocacart/search/search.php. It explains that the exploit relies on a comma-free payload format because the vulnerable code splits input on commas before constructing SQL. It also notes that the underlying query path is executed twice per request, amplifying timing differences. Main exploit capability: unauthenticated extraction of database content via time-based blind SQLi, with the included automation focused on credential hash theft. Secondary documented capability in the README includes potential broader database disclosure and possible write operations under favorable DB settings, though the provided code only performs read-oriented blind extraction. Overall, this is a concise operational PoC for web-based SQL injection against vulnerable Phoca Cart deployments.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.