CVE-2026-74251

Name of the Vulnerable Software and Affected Versions Phoca Cart versions 5.0.0 through 6.1.16

Description An unauthenticated attacker can perform a SQL injection on the public shop items page. The issue occurs because the GET array parameters a[] (attribute) and s[] (specification) are concatenated directly into SQL WHERE clauses without proper parameterization or escaping. This allows for full database extraction using time-based blind techniques, where the attacker infers data by observing the time the server takes to respond to specific queries.

Recommendations Update Phoca Cart to a version newer than 6.1.16. As a temporary mitigation, restrict access to the public shop items page or filter the a[] and s[] parameters at the web application firewall level.