CVE-2026-76565 in Cart Extension
Summary
by MITRE • 08/20/2026
Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in the Phoca Cart extension for Joomla, specifically affecting versions from 5.0.0 through 6.1.7, represents a classic reflected cross-site scripting flaw rooted in insufficient input validation and output encoding within the application's filtering mechanisms. This security defect is primarily triggered by two specific query string parameters: price_from and price_to. These parameters are designed to allow users to filter product listings based on a specified price range during e-commerce transactions or browsing sessions. The core technical failure lies in the backend processing logic, which accepts these user-supplied values without adequately sanitizing them before embedding them into the HTML response sent back to the client browser. Consequently, when an attacker crafts a malicious URL containing script payloads within these parameters and lures a victim to visit it via phishing or other social engineering tactics, the web server reflects the unsanitized input directly into the page content. This allows arbitrary JavaScript code to execute in the context of the victim's session with the Joomla site, leveraging the trust that browsers place in pages served by the originating domain.
From an architectural perspective, this vulnerability aligns closely with CWE-79, which categorizes improper neutralization of input during web page generation as a cross-site scripting weakness. The reflection aspect indicates that it is classified under CWE-80, distinguishing it from stored XSS variants where malicious data persists in the database. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates techniques associated with Initial Access and Execution, specifically falling under T1189 Drive-by Compromise or potentially T1059 Command and Scripting Interpreter if the payload is designed to execute further commands within the browser environment. The impact extends beyond mere script execution; it enables session hijacking through cookie theft, allowing attackers to impersonate legitimate users and gain unauthorized access to their accounts. Furthermore, because Phoca Cart handles sensitive e-commerce data including customer details and potentially payment information in subsequent steps of a transaction flow, successful exploitation could lead to broader compromise of the merchant's operational integrity or facilitate phishing attacks against other customers by redirecting them to malicious sites that mimic legitimate checkout pages.
The operational impact on organizations utilizing vulnerable versions of Phoca Cart is significant due to the potential for data exfiltration and reputation damage. Attackers can manipulate the user interface, deface webpages, or deploy keyloggers to capture sensitive information entered into forms on subsequent pages within the same session if cookies are not properly secured with HttpOnly flags. Additionally, reflected XSS vulnerabilities often serve as a vector for delivering malware downloads by exploiting browser vulnerabilities that may be present in outdated client software. For administrators and developers maintaining Joomla-based e-commerce platforms, addressing this issue requires immediate attention to input validation practices. Mitigation strategies must include implementing strict allow-listing for the price_from and price_to parameters to ensure only valid numeric values are accepted, thereby rejecting any non-numeric characters or script tags at the entry point. Furthermore, output encoding should be enforced using context-aware methods such as HTML entity encoding when rendering user-supplied data in web pages. Upgrading to a patched version of Phoca Cart that resolves this flaw is the most effective long-term solution, ensuring that all known security issues related to input handling are addressed by the vendor's development team through rigorous code review and testing protocols aligned with secure software development lifecycle standards.