Phoca Cart EUVD-2026-63215

Exploitation requires that the target site runs Phoca Cart version 5.0.0 through 6.1.7 as a Joomla extension, and that the attacker can submit any request that creates an order - a capability available to any unauthenticated visitor to the storefront. The User-Agent header on that request must be attacker-controlled, which is trivially achievable with any HTTP client. The stored payload only executes when a Joomla administrator navigates to the Admin Order View and renders the malicious order entry; without that administrator interaction (UI:A per CVSS 4.0), the stored payload remains inert. Limiting factors: the admin must actively view the affected order, meaning the attacker cannot force immediate execution and may need to rely on normal admin review cadence; the XSS executes only within the Joomla admin session, so the impact is bounded to that CMS context rather than affecting other system layers directly.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) captures the key risk profile accurately: the attack is network-reachable, requires no privileges, imposes no special attack requirements, and carries high confidentiality and integrity impact, with the sole friction being that an administrator must actively open the malicious order (UI:A). No EPSS score was provided in the available data, and the vulnerability is not listed in CISA KEV, indicating no confirmed active widespread exploitation at this time. No POC exploit code has been identified, though the technique - injecting JavaScript into an HTTP header that is later rendered in a CMS admin panel - is well-understood and requires minimal sophistication. The practical exploitation bar is very low: any visitor to the storefront can trigger the injection phase without authentication, and order review is a routine administrative task that naturally brings admins to the vulnerable view. The absence of KEV listing should not invite complacency; the attack requires only that an admin perform their normal duties after a malicious order is placed.

An unauthenticated attacker submits a purchase on a vulnerable Phoca Cart storefront, setting the HTTP User-Agent header to a JavaScript payload such as a cookie-exfiltration script targeting document.cookie. When a Joomla administrator next opens the Admin Order View to process orders - a routine daily task - the stored payload executes silently in their browser, sending the admin's session token to an attacker-controlled endpoint. With the admin session token in hand, the attacker can authenticate to the Joomla backend and perform any action available to that administrator account.