Summary
CVE-2026-74251 is a critical, unauthenticated SQL injection vulnerability in Phoca Cart, a shopping-cart extension for Joomla. The flaw resides in the public-facing shop items page and lets a remote, unauthenticated attacker extract database contents via time-based blind SQL injection. It carries a CVSS score of 9.3 (Critical).
Technical details
- Root cause: The
a[](attribute) ands[](specification) GET parameters on the shop items page are concatenated directly into SQLWHEREclauses without parameterization or escaping. - Trigger conditions: Sending crafted values in the
a[]ands[]query parameters to a public Phoca Cart shop listing page. - Attack vector: Network-based, requires no authentication and no user interaction (CWE-89, SQL Injection).
- Impact: Time-based blind SQL injection enabling extraction of database contents; the associated CVSS impact metrics indicate high potential impact to confidentiality, integrity, and availability of the underlying database.
Affected software
- Phoca Cart extension for Joomla, versions 5.0.0 through 6.1.6.
Severity
- CVSS v4.0 Base Score: 9.3 (Critical)
- Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate: No vendor-confirmed patched version has been published in the CVE record at the time of writing. Check the Phoca vendor site and downloads page for any Phoca Cart release newer than 6.1.6 and apply it as soon as it is available.
- If no patch is available: Restrict or monitor public access to the Phoca Cart shop items page, deploy a web application firewall rule to block or sanitize the
a[]ands[]GET parameters, and monitor database/web server logs for time-delay based SQL injection probing patterns against these parameters.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
/media/com_phocacart/,/images/phocacartproducts/,/component/phocacart,/components/com_phocacart/ - URL of a loaded script:
/media/com_phocacart/

