CVE-2026-90902: Joomla Easy Store SQL Injection Vulnerability

CVE-2026-90902 Overview

CVE-2026-90902 is an authenticated SQL injection vulnerability in the JoomShaper EasyStore extension for Joomla, versions 1.0.0 through 3.0.0. The flaw resides in the coupon bulk update task exposed at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. Input IDs are concatenated directly into raw SQL IN (...) clauses inside ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator can inject arbitrary SQL syntax through the vulnerable parameter. The classification maps to [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
An authenticated administrator can inject arbitrary SQL into the Joomla database backend through the coupon bulk update endpoint, exposing store, customer, and configuration data.

Affected Products

JoomShaper EasyStore extension for Joomla — version 1.0.0
JoomShaper EasyStore extension for Joomla — versions 2.x
JoomShaper EasyStore extension for Joomla — versions up to and including 3.0.0

Discovery Timeline

2026-09-23 - CVE-2026-90902 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-90902

Vulnerability Analysis

The EasyStore administrator interface exposes a bulk coupon update task that accepts an array of coupon identifiers. The backend handler builds a SQL statement dynamically by concatenating those identifiers into an IN (...) clause. Because the values are inserted as raw strings, an attacker controlling the request payload can break out of the intended clause and append arbitrary SQL. The vulnerable code paths sit in ProductCoupon.php and CouponsModel.php, both of which handle coupon record updates. Exploitation requires an authenticated administrator session on the Joomla backend, which limits the pool of eligible attackers but does not reduce the impact once triggered. The injected query executes with the same privileges as the Joomla database user, typically granting read and write access across every table in the site schema.

Root Cause

The root cause is unsafe string concatenation of user-supplied identifiers into raw SQL. The code trusted the request payload to contain numeric IDs and did not enforce type constraints or use prepared statements. No sanitization filter, integer cast, or parameter binding sat between the HTTP input and the database driver.

Attack Vector

An authenticated administrator sends a crafted POST request to administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate with malicious values placed in the coupon ID array parameter. The injected fragment closes the IN (...) clause, appends a UNION SELECT or subquery, and returns arbitrary data through the query response or timing side channels. See the JoomShaper EasyStore product page for extension details and update channels.

Detection Methods for CVE-2026-90902

Indicators of Compromise

Requests to administrator/index.php with option=com_easystore and task=coupon.couponBulkUpdate containing non-numeric characters in ID parameters.
Web server or database logs showing SQL syntax fragments such as UNION SELECT, SLEEP(, --, or /* inside coupon-related request bodies.
Unexpected reads or modifications to Joomla core tables (#__users, #__extensions) originating from the EasyStore administrator context.
New or modified administrator accounts created shortly after a coupon bulk update request.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the com_easystore coupon bulk update task and rejects payloads containing SQL metacharacters in ID arrays.
Enable Joomla database query logging or MySQL general query logging on the store host and alert on IN ( clauses containing non-integer tokens.
Correlate administrator authentication events with subsequent bulk update requests to surface compromised admin accounts.

Monitoring Recommendations

Track HTTP 500 responses and database error strings emitted by the EasyStore administrator endpoints, which often accompany failed injection probes.
Monitor changes to the #__easystore_coupons and related tables outside expected administrative workflows.
Alert on outbound connections from the Joomla host that follow coupon bulk update activity, which may indicate data exfiltration.

How to Mitigate CVE-2026-90902

Immediate Actions Required

Upgrade the EasyStore extension to a version released after 3.0.0 that includes the fix cited by the vendor.
Restrict access to administrator/index.php using IP allowlisting or VPN-only access until the patch is applied.
Rotate credentials for every Joomla administrator account and audit the #__users table for unexpected entries.
Review recent database backups for signs of tampering in coupon, user, and configuration tables.

Patch Information

The vendor resolved the issue by strictly casting all IDs to integers using array_map('intval', ...) and adopting parameterized ->whereIn() query construction in both ProductCoupon.php and CouponsModel.php. Administrators should install the latest EasyStore release available from JoomShaper and confirm the coupon models reflect the parameterized query pattern. Refer to the JoomShaper EasyStore product page for release notes and download links.

Workarounds

Temporarily disable the EasyStore component from the Joomla Extensions Manager if patching cannot occur immediately.
Remove or restrict access to the coupon bulk update task through server-level rewrite rules that block requests containing task=coupon.couponBulkUpdate.
Enforce least-privilege on the Joomla database user so that injected queries cannot access unrelated schemas.

bash

# Example Apache rewrite rule to block the vulnerable task until patched
RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)option=com_easystore(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)task=coupon\.couponBulkUpdate(&|$) [NC]
RewriteRule ^administrator/index\.php$ - [F,L]