## https://sploitus.com/exploit?id=AC02CD58-CB4D-5B08-AEA0-5E0D170F0392
# Reflected XSS via search GET Parameter in Phoca Download
**Phoca Download ≤ 6.1.4 — Authenticated Attacker Executes Arbitrary JavaScript via Crafted Search URL in User Control Panel**
---
## SUMMARY
Phoca Download (`com_phocadownload`) for Joomla contains a reflected Cross-Site Scripting (XSS) vulnerability in the User Control Panel file search functionality. The `search` GET parameter is processed with Joomla's `'string'` filter — which calls `strip_tags()` only and preserves the `"` character — then echoed without `htmlspecialchars()` into an HTML `` attribute. An attacker can inject arbitrary HTML attributes and event handlers that execute in the victim's browser upon page load, without requiring any user interaction beyond clicking a crafted link.
---
## AFFECTED VERSIONS
| COMPONENT | VULNERABLE | TESTED ON | FIXED |
| ----------------- | ---------- | --------------------------------------------- | ----- |
| com_phocadownload | ≤ 6.1.4 | Joomla 5 + PhocaDownload 6.1.4 + MariaDB 10.6 | 6.1.5 |
---
## VULNERABILITY DETAILS
**Type:** Reflected Cross-Site Scripting (CWE-79)
**Authentication required:** Registered Joomla user (logged in) + User Control Panel enabled (`enable_user_cp = 1`)
**CSRF token required:** Not required — GET request, no CSRF token checked on this path
**Sink file:** `site/views/user/tmpl/default_files_bootstrap.php`
### Root Cause
The `search` parameter is read using Joomla's `'string'` filter, which only calls `strip_tags()`. This preserves the `"` character, allowing an attacker to break out of the `value=""` attribute context and inject arbitrary HTML attributes.
**SITE/VIEWS/USER/VIEW.HTML.PHP:252 — SOURCE**
```php
$search_files = $app->getUserStateFromRequest(
$this->_context_files.'.search', 'search', '', 'string'
);
$search_files = StringHelper::strtolower($search_files);
$lists_files['search'] = $search_files; // stored without encoding
```
**SITE/VIEWS/USER/TMPL/DEFAULT_FILES_BOOTSTRAP.PHP:56 — SINK (VULNERABLE)**
```php
t['listsfiles']['search'];?>"
class="form-control" />
```
The sibling view `phocadownloadlinkfile` (same extension) correctly applies `PhocaDownloadUtils::filterValue($search, 'text')` — equivalent to `htmlspecialchars()` — for the same search field. The `user` view does not apply the same protection, indicating inconsistent output encoding within the extension.
---
## PROOF OF CONCEPT
#### 1. Log in as a Registered User
Navigate to the Joomla login page and authenticate as a Registered user. After successful login, Joomla redirects to the user profile page, confirming an active session.
#### 2. Access the User Control Panel (Baseline)
Navigate to the PhocaDownload User Control Panel:
```
http://TARGET/index.php?option=com_phocadownload&view=user
```
The page renders with an empty search field (`value=""`). This is the normal state before injection.
#### 3. Submit Crafted URL with XSS Payload
Navigate to the following crafted URL (or type the raw payload directly into the search box):
```
http://TARGET/index.php?option=com_phocadownload&view=user&search=%22%20autofocus%20onfocus%3Dalert%28document.domain%29%20x%3D
```
As the page loads, the injected `autofocus` attribute focuses the input element, immediately triggering the `onfocus` event handler. No further user interaction is required.
**Rendered HTML (vulnerable):**
```html
```
---
## IMPACT
1. **Session Hijacking** — An attacker can steal the victim's Joomla session cookie via `document.cookie`, enabling full account takeover without credentials.
2. **Arbitrary JavaScript Execution** — Any JavaScript executes in the victim's browser session — keylogging, DOM manipulation, credential harvesting, and redirects to phishing pages are all possible.
3. **Privilege Escalation** — If an administrator clicks the crafted link while authenticated, the attacker gains admin-level JavaScript execution, potentially enabling full site compromise via administrative panel actions.
---
## REFERENCES
- **CVE:** https://vulners.com/cve/CVE-2026-76569
- **NVD:** https://nvd.nist.gov/vuln/detail/CVE-2026-76569
- **GitHub Advisory:** https://github.com/advisories/GHSA-99wr-9r6w-w242
- **Vendor Repository:** https://github.com/PhocaDesign/PhocaDownload