Reflected XSS Vulnerability in PhocaCart and mod_phocacart_filter

PhocaCart version 6.1.7 and earlier, when used with the mod_phocacart_filter module, contains a reflected Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-76565. The flaw originates from the application's failure to properly sanitize the 'price_from' and 'price_to' GET parameters before echoing them into HTML value attributes. While the application uses Joomla's 'string' input filter, this only applies 'strip_tags()' and fails to encode HTML special characters such as double quotes. An unauthenticated attacker can leverage this to inject arbitrary JavaScript attributes, such as 'autofocus' and 'onfocus', to trigger code execution in the browser of a victim who visits a crafted URL. This vulnerability impacts the shop frontend, potentially leading to session hijacking, credential harvesting, or unauthorized actions performed under the context of the trusted site.

Impact

The vulnerability enables attackers to perform unauthorized actions on behalf of authenticated or unauthenticated users browsing the shop. Successful exploitation can lead to session cookie theft, session hijacking, phishing through injected content, or forced redirects to malicious domains. Organizations running PhocaCart 6.1.7 or older with the vulnerable filter module are at risk of client-side attacks targeting their customers and administrative staff.

Recommendation

• Update the PhocaCart component and the mod_phocacart_filter module to version 6.1.8 or later immediately to patch the injection sink.
• Implement Content Security Policy (CSP) headers to restrict the execution of unauthorized inline scripts as a defense-in-depth measure.
• Monitor web server logs for requests containing suspicious GET parameters with URL-encoded HTML special characters like %22, %27, or %3E in the 'price_from' and 'price_to' fields.