CVE-2023-54364
MEDIUMJoomla HikaShop 4.7.4 Reflected XSS via Product Filter
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2023-54364. PoCs published by CraCkEr.
AI-analyzed exploit summary The exploit demonstrates a reflected XSS vulnerability in Joomla HikaShop 4.7.4 via multiple GET parameters ('from_option', 'from_ctrl', 'from_task', 'from_itemid'). The provided payload triggers an alert when injected into the vulnerable parameters.
Description
Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link.
Exploits (1)
The exploit demonstrates a reflected XSS vulnerability in Joomla HikaShop 4.7.4 via multiple GET parameters ('from_option', 'from_ctrl', 'from_task', 'from_itemid'). The provided payload triggers an alert when injected into the vulnerable parameters.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N