CVE-2026-74251 phoca.cz CVE debrief

Who should care

Joomla users with Phoca Cart extension installed, security teams monitoring for SQL injection attacks, and operators of e-commerce platforms using Phoca Cart should be aware of this vulnerability. They should review their deployments, assess potential impact, and plan for remediation or mitigation. Vulnerability management and security teams should prioritize this issue due to its critical severity and potential for significant impact. Monitoring and detection teams should be prepared to identify potential exploitation attempts. Asset inventory and patch management processes should be updated to address this vulnerability. Change management and incident response teams should be aware of the potential for exploitation and have plans in place for rapid response and remediation. Source tracking and exposure review teams should verify the presence of affected systems and assess their exposure. Compensating controls, such as web application firewalls, may be necessary for exposed systems while remediation is scheduled and verified. Exception tracking and retest processes should be updated to ensure that remediated assets are properly verified. This vulnerability affects Phoca Cart versions 5.0.0-6.1.6 and may impact other products that use the same vulnerable component. The attack surface includes public shop items pages, and defenders should focus on securing these areas. The vulnerability allows for full database extraction via time-based blind techniques, which can lead to significant data breaches if exploited. Therefore, immediate attention and remediation are crucial to prevent potential attacks. The CVSS score of 9.3 indicates a critical vulnerability that requires urgent attention. The vector of attack involves injecting arbitrary SQL through the a[] and s[] parameters, which can be done without authentication. This makes it a high-risk vulnerability that needs to be addressed promptly. The recommended actions include inventory and version checks for Phoca Cart extension, application of vendor remediation when available, monitoring for suspicious SQL queries, implementation of compensating controls, and exception tracking and retest. By following these steps,

Technical summary

The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An unauthenticated attacker can inject arbitrary SQL through these parameters, enabling full database extraction via time-based blind techniques. This vulnerability has a CVSS score of 9.3 and is considered CRITICAL.

Defensive priority

Critical vulnerability in Phoca Cart extension for Joomla, allowing unauthenticated SQL injection via attribute filter.

Recommended defensive actions

• Inventory and version checks for Phoca Cart extension
• Application of vendor remediation when available
• Monitoring for suspicious SQL queries
• Implementation of compensating controls
• Exception tracking and retest

Evidence notes

The a[] (attribute) and s[] (specification) GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping, enabling full database extraction via time-based blind techniques. This issue affects Joomla users with Phoca Cart extension installed. Security teams should monitor for suspicious SQL queries. Defenders should verify the presence of vendor patches and consider compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.