CVE-2019-9184

CRITICAL LAB

J2store < 3.3.7 - SQL Injection

Title source: rule

Description

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option[] parameter.

Exploits (2)

exploitdb WRITEUP VERIFIED
by Andrei Conache · textwebappsphp
https://www.exploit-db.com/exploits/46467
nomisec WORKING POC
by cved-sources · poc
https://github.com/cved-sources/cve-2019-9184

References (3)

Scores

CVSS v3 9.8
EPSS 0.2033
EPSS Percentile 95.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Lab Environment

COMMUNITY
Community Lab
docker pull cved/base-joomla

Details

CWE
CWE-89
Status published
Products (1)
j2store/j2store 3.3.0 - 3.3.7
Published Feb 26, 2019
Tracked Since Feb 18, 2026