Executive brief
Hikashop, a popular e-commerce extension for the Joomla content management system, contains a security flaw that allows for open redirects. This vulnerability can be used by attackers to craft malicious links that appear to originate from a trusted website but instead redirect users to external, potentially harmful sites. Such attacks are commonly used in phishing campaigns to steal user credentials or distribute malware by leveraging the reputation of the trusted domain.
Technical details
An open redirect vulnerability (CWE-601) exists in the Hikashop extension for Joomla in versions 1.0.0 through 6.5.1. The application fails to properly validate or sanitize user-supplied input used in redirection parameters, allowing a remote attacker to construct a URL that redirects a victim to an untrusted external domain. This is typically exploited via a specially crafted link sent to a user. While the vulnerability itself does not allow for direct data theft, it is a common primitive used in phishing attacks to bypass security filters and gain user trust. Users should update to a version beyond 6.5.1 if available.
Affected products
- hikashop.com Hikashop extension for Joomla 1.0.0-6.5.1
Timeline
- 2026-07-20: disclosed: CVE-2026-61901 published by the Joomla! Project