Stored XSS in J2Commerce via Guest Checkout Filter Bypass

J2Commerce (com_j2store) versions 4.1.5 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-74252) within the guest checkout billing address fields. The vulnerability is caused by a filter bypass in Joomla's Input::getArray() method, which can be exploited when PHP's variables_order configuration defaults to 'EGPCS' (Cookie overrides POST in $_REQUEST).

An unauthenticated attacker can submit a malicious payload in cookie fields that are then stored unsanitized in the j2store_orderinfos database table. Because the J2Commerce administrator order management panel fails to encode these fields when rendering the orders list, the payload executes automatically in the administrator's browser as soon as the orders listing page is loaded. This allows for session hijacking, unauthorized creation of administrator accounts, or the installation of malicious plugins to achieve further system compromise. The vulnerability affects any hosting environment where cookies take precedence over POST data in $_REQUEST.

Attack Chain

1. Attacker sends a GET request to the J2Commerce frontend to obtain a CSRF token.
2. Attacker adds an item to the cart using option=com_j2store&view=carts&task=addItem.
3. Attacker submits a POST request to guest_validate containing both a POST parameter first_name=RAW to trigger the filter bypass and a Cookie first_name containing the XSS payload.
4. Attacker completes the shipping validation step to set the necessary session data.
5. Attacker completes the payment selection step.
6. Attacker finalizes the order via confirmPayment, which causes the backend to store the unsanitized XSS payload in the database.
7. Administrator accesses the J2Commerce orders management interface.
8. The XSS payload executes automatically in the administrator's browser context, potentially leading to account takeover or webshell deployment.

Impact

Successful exploitation results in full site compromise. An attacker can hijack administrative sessions, create new super-administrator accounts, or install malicious plugins to execute arbitrary PHP code on the server. Because the payload triggers automatically upon viewing the orders list, it requires no user interaction beyond the administrator's routine order management, and it persists until the malicious order record is removed.

Recommendation

• Update J2Commerce (com_j2store) to version 4.1.6 or later to apply the necessary output encoding.
• Monitor web server access logs for anomalous POST requests to com_j2store checkout endpoints containing non-standard Cookie headers.
• Review J2Commerce orders database for suspicious values in the billing_first_name, billing_last_name, or address fields.
• Configure PHP request_order to exclude cookies (e.g., request_order = "GP") if possible to prevent cookie-based override of input parameters, though this is a defense-in-depth measure.