The Easy Store extension for Joomla versions 1.0.0 to 3.0.0 had a CSRF vulnerability in the product review submission endpoint (index.php?option=com_easystore&task=product.addReview). The anti-CSRF token verification was missing because the check was commented out in the code. This allowed attackers to perform unauthorized review submissions by exploiting the lack of token validation. The fix involved enforcing Session::checkToken('request') and Session::checkToken('post') in the ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.

An attacker could trick a logged-in user into submitting unauthorized product reviews or review spam via cross-site requests. This could lead to manipulation of product review content, potentially damaging the integrity of the review system and misleading users. There is no indication of privilege escalation or direct compromise of user accounts or data beyond review submissions.

A fix is available and has been implemented by the vendor. The vulnerability was resolved by enforcing anti-CSRF token checks in the ProductController and ensuring the review form includes the session token in the submission payload. Users should update to a patched version of the Easy Store extension that includes these fixes. No additional mitigation steps are required beyond applying the official fix.