Phoca Cart Extension For Joomla
Monthly
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).