Joomla HikaShop Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Joomla HikaShop version 4.7.4. This vulnerability allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft URLs with XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters. When victims click on these links, the injected scripts can steal session tokens or login credentials.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a link containing a malicious payload in one of the vulnerable GET parameters (from_option, from_ctrl, from_task, or from_itemid) to a victim. When the victim clicks the link, the injected script will execute, demonstrating the cross-site scripting vulnerability.