An unauthenticated SQL injection vulnerability in the Joomshaper Easy Store extension for Joomla poses a critical risk of full database compromise.

The extension fails to properly validate order parameters, which allows an unauthenticated attacker to inject malicious SQL commands and gain full read access to the database.

Successful exploitation permits unauthorized access to sensitive information, including user credentials and active session tokens. Given the CVSS score of 9.3, this flaw presents a severe risk that could lead to full system takeover and significant data breaches.

Immediate Action: Review the official Joomshaper advisory to identify the specific patched version and apply the update immediately.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected syntax or unexpected volume of data requests originating from non-administrative users.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection payloads targeting Joomla extensions.

Public Exploit Available: unknown

Due to the critical nature of this SQL injection vulnerability, administrators must prioritize identifying and patching affected instances immediately. The potential for total database compromise necessitates an urgent update to the latest available version provided by Joomshaper.