IMPORTANT: SQL Injection fix for J2Store 3.3.2 and lower

product.php

//SQL Injection fix for J2Store 3.3.2 and lower

//File path: /administrator/components/com_j2store/helpers/product.php

//around line number 1137, you will find

if(empty($option_value)) return $ovsets;

//Change this to

if(empty($option_value)) return $ovsets;

if(is_array($option_value)){
        JArrayHelper::toInteger($option_value);
        $option_value = implode(',',$option_value);
      }else {
        $option_value = intval($option_value);
      }

//Save

//Around line 1149, you will find

$query->where('pov.j2store_product_optionvalue_id='.$option_value);
			$query->where('pov.productoption_id='.$product_option_id);

//Change this to

$query->where('pov.j2store_product_optionvalue_id='.$db->q($option_value));
$query->where('pov.productoption_id='.$db->q($product_option_id));