CyberRota Analysis
AI-GeneratedThe Easy Store extension for Joomla is vulnerable due to missing CSRF protection and inadequate access control, allowing unauthorized modification of core mail configuration settings. This flaw enables attackers to alter the site's sender name and email address through forged requests, potentially leading to phishing or spam campaigns. Joomla administrators using versions 1.0.0 to 3.0.0 should prioritize patching this vulnerability to safeguard their sites from exploitation.
Original NVD Description
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().