Executive brief
A vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap platform, an online store solution. An unauthenticated attacker can use a hidden programming interface (API) to create unauthorized product listings containing malicious scripts. When a customer or administrator views these products, the scripts execute in their browser, potentially leading to account takeover, data theft, or website defacement.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f5. The root cause is two-fold: first, the REST API endpoint '/index.php/api/product/set' is exposed without authentication (CWE-306) due to 'rest_auth' being disabled in the configuration. Second, the application fails to sanitize or encode the 'title' and 'description' arguments before storing them and subsequently rendering them in frontend templates (CWE-79). A remote, unauthenticated attacker can send a POST request to the hidden API to inject malicious JavaScript. The script executes when a victim views the affected product page. A patch has been released in commit d9785f9 which implements session-based authentication checks and HTML output encoding.
Affected products
- kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04
Timeline
- 2026-05-20: patched: Fix committed to repository
- 2026-05-20: advisory: GitHub Security Advisory published
- 2026-07-04: disclosed: NVD publication date
References
- https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/
- https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d9785f995da77bdc62fb2d34bad5f7a162c9ad23
- https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-8q62-q8qx-j49g
- https://vuldb.com/cve/CVE-2026-14633
- https://vuldb.com/submit/845903
- https://vuldb.com/vuln/376148
- https://vuldb.com/vuln/376148/cti