cbcvebase.
CVE-2019-9184
published 2019-02-26

CVE-2019-9184: SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the…

PriorityP270critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
8.98%
94.6th percentile
SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option[] parameter.

Affected

1 ranges
VendorProductVersion rangeFixed in
j2storej2store>= 3.3.0 < 3.3.73.3.7

Detection & IOCsextracted from sources · hover to see the quote

url/index.php?option=com_j2store&view=product&task=update&product_option[j]=%27%22%3E2&product_qty=1&product_id=XX&option=com_j2store&ajax=0&_=XXXXXXXXXX↗
commandproduct_option[j]=%28CASE%20WHEN%20%284862%3D4862%29%20THEN%204862%20ELSE%204862%2A%28SELECT%204862%20FROM%20DUAL%20UNION%20SELECT%205348%20FROM%20DUAL%29%20END%29↗
  • →Monitor HTTP requests targeting the Joomla J2Store component via the 'product_option[]' array parameter for SQL injection payloads (e.g. quotes, CASE/WHEN constructs, UNION SELECT). ↗
  • →Alert on requests to index.php containing both 'option=com_j2store' and 'task=update' with a 'product_option' parameter containing URL-encoded SQL metacharacters such as %27, %22, %28, %29, or UNION/SELECT/CASE keywords. ↗
  • →The vulnerability is exploitable by unauthenticated remote attackers ('any visitor'), so detection should cover anonymous/unauthenticated sessions targeting the J2Store component. ↗
  • ·Only J2Store plugin versions 3.x through 3.3.6 are vulnerable; version 3.3.7 and later are patched. Scope detection rules to installations running affected versions. ↗
  • ·The index 'j' in product_option[j] is dynamic and depends on the number of product option entries; detection patterns must use a wildcard/regex for the array index rather than a fixed value. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.