Stored Cross-Site Scripting in HikaShop Joomla Component
CVE-2024-40746

5.4MEDIUM

Key Information:

Vendor

Hikashop.com

Status
Hikashop Component For Joomla
Vendor
CVE Published:
21 October 2024

What is CVE-2024-40746?

A stored cross-site scripting (XSS) vulnerability exists in the HikaShop Joomla Component versions below 5.1.1, allowing attackers to inject arbitrary JavaScript into the web browser of users. This exploit occurs when a malicious payload is inserted into the 'description' parameter of any product, as the input is not properly sanitized in the backend. This lack of sanitization exposes users to significant security threats, enabling potential data leakage and unauthorized actions when they interact with the affected component.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

HikaShop component for Joomla 1.0.0-5.1.0

References

https://www.hikashop.com/
product

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.