An authenticated administrator with sufficient privileges can inject arbitrary SQL through the coupon bulk update task, which concatenates raw coupon IDs into an IN (…) clause in the database query. This lack of input sanitization allows the attacker to read sensitive database information, modify or delete coupon data, or inject further SQL commands that could affect other tables. The flaw exemplifies CWE‑89, an improper handling of client input in SQL statements.

The Easy Store Joomla extension from joomshaper.com, versions 1.0.0 through 3.0.0, exposes the coupon bulk update feature to administrators without sanitizing the coupon ID list.

The CVSS score of 8.6 reflects a high severity vulnerability, while the EPSS score of less than 1% indicates a low current exploitation probability. Although the vulnerability is not listed in the CISA KEV catalog, its impact is significant for any site employing vulnerable Easy Store versions. Because the flaw requires authenticated administrator access, exploitation is limited to accounts with those credentials; an attacker could use the injection to read or alter database content by sending a crafted request to the coupon.couponBulkUpdate administrative endpoint.