Executive brief
Phoca Cart is a Joomla e-commerce extension used to build online stores and shopping carts. The extension contains a stored cross-site scripting (XSS) vulnerability in the admin order view that allows attackers to inject malicious code via the User-Agent header, which can then execute when administrators view orders. This could enable session hijacking, admin account compromise, or malware injection into the store's admin panel.
Technical details
A stored XSS vulnerability exists in Phoca Cart versions 5.0.0 through 6.1.7 in the admin order view. The vulnerability stems from insufficient sanitization of the User-Agent header when orders are processed and displayed in the Joomla admin backend. An attacker can inject malicious JavaScript through the User-Agent header of an HTTP request, which is stored in the order and executed when an administrator views the order details. The attack requires no special privileges and can be triggered by making a purchase or order with a crafted User-Agent header. The injected script executes in the context of the admin user's session, potentially allowing full compromise of the Joomla instance.
Affected products
- phoca.cz Phoca Cart 5.0.0 through 6.1.7
Timeline
- 2026-08-20: disclosed