Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105605— Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3

Quick assessment

Affected
dj-extensions.com DJ-Classifieds extension for Joomla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joomla 扩展组件（dj-extensions.com）存在 IDOR（不安全的直接对象引用）漏洞，影响 DJ-Classifieds 3.11.3 以下版本。该漏洞源于“复制我的广告”这一便捷功能：在发布新广告的表单（site/models/additem.php）中，系统直接使用原始数字 ID 加载现有广告，却未验证该广告是否属于当前请求用户，也未检查广告是否已发布、被屏蔽或仍为待审草稿。因此，任何已登录用户（无论其角色如何）均可通过向新广告表单提交其他广告的 ID，获取该广告的完整内容（包括卖家的电话号码

CVSS 5.3 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
dj-extensions.com DJ-Classifieds extension for Joomla 1.0-3.11.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105605

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no check that the ad belonged to the requesting user, and no check of whether it was published, blocked, or still a pending draft. Any logged-in user, regardless of role, could request the new-ad form with another ad’s ID and have that ad’s full content, including the seller’s phone number, address, email, and price, rendered into the response, even for ads that had never been published. Advert IDs are small sequential integers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
dj-extensions.com DJ-Classifieds extension for Joomla 1.0-3.11.2 -

II. Public POCs for CVE-2026-105605

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105605

请登录查看更多情报信息。

Same Patch Batch · dj-extensions.com · 2026-11-02 · 3 CVEs total

CVE-2026-105603 9.4 CRITICAL Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifie
CVE-2026-105604 9.3 CRITICAL Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3

IV. Related Vulnerabilities

Same product: DJ-Classifieds extension for Joomla
Same vendor: dj-extensions.com
Same weakness: CWE-639