Stored Cross-Site Scripting in HikaShop Joomla Component

CVE-2024-40746

What is CVE-2024-40746?

A stored cross-site scripting (XSS) vulnerability exists in the HikaShop Joomla Component versions below 5.1.1, allowing attackers to inject arbitrary JavaScript into the web browser of users. This exploit occurs when a malicious payload is inserted into the 'description' parameter of any product, as the input is not properly sanitized in the backend. This lack of sanitization exposes users to significant security threats, enabling potential data leakage and unauthorized actions when they interact with the affected component.

References