CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link.
Explanation of Vulnerability in Simple Terms
HikaShop for Joomla contains a cross-site scripting (XSS) vulnerability in version 4.7.4. An attacker can inject malicious scripts that execute in users' browsers when they visit affected pages. The vulnerability requires user interaction to trigger. This can lead to session hijacking, credential theft, or malware distribution to site visitors.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers and steals session cookies or credentials.
Potential impact on your site
Visitors' accounts and data are at risk; your site's reputation may be damaged if used to distribute malware.
Conditions required to exploit
Attacker must craft a malicious link or page; victim must click it or visit an affected page.
Key dates
External resources
Related vulnerabilities
