EUVD-2025-18143
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:N/RE:L/U:Clear
Lifecycle Timeline
3Description
A stored XSS vulnerability in RSTickets! component 1.9.12 - 3.3.0 for Joomla was discovered. It allows attackers to perform cross-site scripting (XSS) attacks via sending crafted payload.
Analysis
RSTickets! component for Joomla versions 1.9.12 through 3.3.0 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious scripts into the application, which are then executed in the browsers of other users who view the affected content. With a CVSS score of 8.5 and requiring low privilege level plus user interaction, this vulnerability poses a significant risk to Joomla installations using vulnerable RSTickets! versions, particularly in multi-user environments where attackers can escalate privileges or steal administrative credentials.
Technical Context
The vulnerability exists in the RSTickets! Joomla component (CPE: cpe:2:a:rsjoomla:rstickets:*), a ticketing system extension. The root cause is improper input validation and output encoding in user-controllable fields (CWE-79: Improper Neutralization of Input During Web Page Generation), allowing attackers to bypass content sanitization filters. The stored nature of the XSS means payloads persist in the application database and execute whenever affected content is rendered, affecting all users who interact with the compromised ticket or message without requiring the attacker to be present during exploitation. The vulnerability affects versions from 1.9.12 through 3.3.0, indicating a regression or long-standing flaw across multiple release cycles.
Affected Products
RSTickets! (1.9.12 through 3.3.0 (inclusive))
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today