CyberRota Analysis
AI-GeneratedThe J2Store extension for Joomla is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields, allowing unauthenticated attackers to inject and store malicious HTML. This vulnerability arises from a filter bypass in Joomla's input handling, which can lead to the execution of arbitrary scripts when the stored data is rendered. Organizations using affected versions of J2Store, particularly those with guest checkout enabled, should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST ) to store unsanitized HTML in fields such as billing_first_name.