CyberRota Analysis
AI-GeneratedThe J2Store extension for Joomla is vulnerable to unauthenticated file uploads due to a lack of CSRF protection and insufficient directory restrictions, allowing attackers to upload malicious files directly to the server. This vulnerability can lead to unauthorized access and potential exploitation of the web application, making it critical for users of J2Store versions 1.0.0-4.1.5 to prioritize remediation. Organizations using these versions should implement immediate security measures to mitigate the risk of file-based attacks.
Original NVD Description
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.