## https://sploitus.com/exploit?id=B44477A4-3D6C-5E09-AA00-D0C0AE67D2FE
# Stored XSS via User-Agent in Admin Order View in PhocaCart
**PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Stores XSS Payload via Checkout. Executes in Admin Browser Context**
---
## SUMMARY
PhocaCart 6.1.7 for Joomla stores the raw HTTP `User-Agent` header from checkout requests in the orders database table when the `store_user_agent` configuration option is enabled. The stored value is subsequently rendered without HTML encoding into the administrator order edit view via `itemText()` in `Adminview.php`.
An unauthenticated attacker can place an order with a crafted `User-Agent` containing a JavaScript payload. When an administrator opens the order in the backend, the payload executes in the admin browser context — enabling session hijacking, credential theft, or unauthorized administrative actions.
The vulnerability requires `store_user_agent = 1` (non-default) to be enabled. Because this option is a deliberate administrator choice to collect browser statistics, affected shops are those where the shop owner has enabled the feature — making exploitation fully silent from the attacker's perspective.
---
## AFFECTED VERSIONS
| COMPONENT | VULNERABLE | TESTED ON | FIXED |
| ------------------------- | -------------- | --------------------------------------------- | ----- |
| PhocaCart (com_phocacart) | 5.0.0 – 6.1.7 | Joomla 5.4.7 + PhocaCart 6.1.7 + MariaDB 10.6 | 6.1.8 |
---
## VULNERABILITY DETAILS
**Type:** Stored XSS (CWE-79) — admin-targeted
**Authentication required:** None to inject. Administrator to trigger
**CSRF token required:** Yes (standard Joomla CSRF token required for checkout)
**File:** `administrator/components/com_phocacart/libraries/Phoca/Render/Adminview.php:382`
### Root Cause
When `store_user_agent = 1`, the method `PhocacartUtils::getUserAgent()` returns `$_SERVER['HTTP_USER_AGENT']` without any sanitization. This raw string is stored in `#__phocacart_orders` (truncated at 200 characters — insufficient to prevent XSS). When an administrator views the order in the backend, `itemText()` concatenates the stored value directly into the HTML response with no call to `htmlspecialchars()`.
Data flow:
```
Attacker sends checkout request:
User-Agent: alert(document.domain)
utils.php:334 PhocacartUtils::getUserAgent()
└─ return (string) $_SERVER['HTTP_USER_AGENT'] // raw, no sanitization
order.php:413 $d['user_agent'] = substr($user_agent, 0, 200)
└─ INSERT INTO #__phocacart_orders (user_agent) VALUES ('...')
Admin opens order in backend:
edit.php:84 echo $r->itemText($this->itemcommon->user_agent, ...)
Adminview.php:382 '' . $item . ''
// → NO htmlspecialchars()
→ Browser renders: alert(document.domain)
→ XSS fires in administrator's browser
```
**ORDER.PHP — STORE PHASE (VULNERABLE SOURCE)**
`administrator/components/com_phocacart/libraries/phocacart/order/order.php:424`
```php
$user_agent = PhocacartUtils::getUserAgent(); // reads $_SERVER['HTTP_USER_AGENT'] raw
$d['user_agent'] = substr($user_agent, 0, 200); // stored in DB unfiltered
```
**ADMINVIEW.PHP:382 — RENDER PHASE (VULNERABLE SINK)**
```php
// No htmlspecialchars() applied:
$output .= ' ' . $item . '' . "\n";
```
Called from `administrator/components/com_phocacart/views/phocacartorder/tmpl/edit.php:84`:
```php
echo $r->itemText($this->itemcommon->user_agent, Text::_('COM_PHOCACART_USER_AGENT'), '', 'user_agent');
```
The `itemText()` function passes `$item` (the stored `user_agent` value) directly into the HTML output with no encoding, making it the primary sink. Fixing it at the sink level protects all callers of `itemText()`.
---
## PROOF OF CONCEPT
The attack requires completing a full checkout flow with a malicious `User-Agent` header. The CSRF token must be obtained first since Joomla's checkout controller validates it.
#### 0. Prerequisite — Enable Store User Agent Information
In Joomla admin, navigate to **Components → Phoca Cart → Options → Main tab → Statistics Options**. Set **Store User Agent Information = Yes** and save.
#### 1. Obtain CSRF Token
The attacker visits the shop frontend to extract a valid Joomla CSRF token required by the checkout controller. The token appears in the HTML source or JavaScript config of any shop page.
#### 2. Add Product to Cart
The attacker adds a product to cart via the AJAX checkout endpoint using a benign `User-Agent`. This transitions the checkout session to the next state.
#### 3. Save Billing Address
The attacker submits billing information to advance the checkout state machine.
#### 4. Save Shipping Method
The attacker selects a shipping method to proceed to payment.
#### 5. Save Payment Method
The attacker selects a payment method (e.g., Cash on Delivery).
#### 6. Inject Payload — Place Order with Malicious User-Agent
Critical injection step. The attacker places the final order via `task=checkout.order` with the `User-Agent` header set to the XSS payload. The `checkout.order` task reads raw `HTTP_USER_AGENT` and stores it unescaped in `#__phocacart_orders.user_agent`.
```
POST /index.php/shop/checkout HTTP/1.1
Host: TARGET
User-Agent: alert(document.domain)
Content-Type: application/x-www-form-urlencoded
phcheckouttac=1&task=checkout.order&option=com_phocacart&return=&=1
```
Result: Order created. Database stores `user_agent = 'alert(document.domain)'`.
#### 7. Admin Views Order List
Administrator navigates to **Components → Phoca Cart → Orders**. The injected order appears in the list. XSS is not yet triggered at this stage.
#### 8. XSS Fires — Admin Opens Order Detail
When the administrator clicks the order to open the edit view, the stored `user_agent` is rendered unescaped via `itemText()`. JavaScript executes immediately.
Trigger URL:
```
/administrator/index.php?option=com_phocacart&view=phocacartorder&layout=edit&id=
```
---
## IMPACT
1. **Admin Session Hijacking** — The XSS payload can exfiltrate the administrator's session cookie, granting full backend access without credentials.
2. **Unauthorized Admin Actions** — Executing in the admin browser context, the payload can perform any backend action: create privileged accounts, install malicious extensions, or modify content.
3. **Persistent Backdoor** — A payload that installs a web shell or creates a rogue admin account persists beyond the XSS event itself, giving the attacker durable access to the server.
---
## REFERENCES
- **CVE:** https://vulners.com/cve/CVE-2026-76564
- **NVD:** https://nvd.nist.gov/vuln/detail/CVE-2026-76564
- **GitHub Advisory:** https://github.com/advisories/GHSA-98mw-pj3j-99v2
- **Vendor Repository:** https://github.com/PhocaDesign/PhocaCart