Junglewise Threat Intelligence

CVE-2026-14634: kirilkirkov Ecommerce-CodeIgniter-Bootstrap stored XSS in Admin Page

CVE-2026-14634 · Severity: medium · CVSS 4.3 · Published 2026-07-04

Technologies: Kirilkirkov Ecommerce-CodeIgniter-Bootstrap. Vendors: Kirilkirkov.

Executive brief

A security vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap shopping platform that allows unauthenticated users to attack the site's administrators. By submitting a newsletter subscription with a specially crafted web browser identifier (User-Agent), an attacker can inject malicious code into the administrative dashboard. When an administrator views the list of subscribed emails, this code executes in their browser, potentially allowing the attacker to steal session data or perform unauthorized actions with administrative privileges.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 213babd. The vulnerability is located in the `checkForPostRequests` function within `application/core/MY_Controller.php`, which handles newsletter subscriptions. The application captures the `HTTP_USER_AGENT` header from the request and stores it directly into the `subscribed.browser` database field without sanitization. When an administrator accesses the 'Subscribed Emails' management page (`/admin/emails`), the stored value is rendered in the view (`application/modules/admin/views/settings/emails.php`) without output encoding. An unauthenticated attacker can exploit this by sending a crafted User-Agent header during a subscription request, leading to arbitrary script execution in the context of an authenticated administrator. A patch is available in commit 23105f2 which implements HTML tag stripping and output encoding.

Affected products

  • kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517

Timeline

  • 2026-05-20: advisory: GitHub Security Advisory GHSA-v69c-5xg5-q7r8 published
  • 2026-05-20: patched: Fix committed to repository
  • 2026-07-04: disclosed: CVE-2026-14634 published to NVD

References

Related threats