CVE-2023-54364

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54364", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-09T20:42:23.652Z", "datePublished": "2026-04-09T20:54:53.568Z", "dateUpdated": "2026-05-24T01:37:42.563Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-24T01:37:42.563Z"}, "title": "Joomla HikaShop 4.7.4 Reflected XSS via Product Filter", "descriptions": [{"lang": "en", "value": "Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "affected": [{"vendor": "Hikashop", "product": "Joomla HikaShop", "versions": [{"version": "4.7.4", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hikashop:hikashop:4.7.4:*:*:*:*:*:*:*"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/51629", "name": "ExploitDB-51629", "tags": ["exploit"]}, {"url": "https://www.hikashop.com/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://demo.hikashop.com/index.php/en/", "name": "Product Reference", "tags": ["product"]}, {"name": "VulnCheck Advisory: Joomla HikaShop 4.7.4 Reflected XSS via Product Filter", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/joomla-hikashop-reflected-xss-via-product-filter"}], "credits": [{"lang": "en", "value": "CraCkEr", "type": "finder"}], "x_generator": {"engine": "vulncheck"}, "datePublic": "2023-07-28T00:00:00.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T18:10:40.728994Z", "id": "CVE-2023-54364", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:10:51.242Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-54364", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:10:40.728994Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:10:46.242Z"}}], "cna": {"title": "Joomla HikaShop 4.7.4 Reflected XSS via Product Filter", "credits": [{"lang": "en", "type": "finder", "value": "CraCkEr"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Hikashop", "product": "Joomla HikaShop", "versions": [{"status": "affected", "version": "4.7.4"}]}], "datePublic": "2023-07-28T00:00:00.000Z", "references": [{"url": "https://www.exploit-db.com/exploits/51629", "name": "ExploitDB-51629", "tags": ["exploit"]}, {"url": "https://www.hikashop.com/", "name": "Official Product Homepage", "tags": ["product"]}, {"url": "https://demo.hikashop.com/index.php/en/", "name": "Product Reference", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/joomla-hikashop-reflected-xss-via-product-filter", "name": "VulnCheck Advisory: Joomla HikaShop 4.7.4 Reflected XSS via Product Filter", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hikashop:hikashop:4.7.4:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-24T01:37:42.563Z"}}}, "cveMetadata": {"cveId": "CVE-2023-54364", "state": "PUBLISHED", "dateUpdated": "2026-05-24T01:37:42.563Z", "dateReserved": "2026-04-09T20:42:23.652Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-09T20:54:53.568Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Joomla HikaShop", "vendor": "Hikashop", "versions": [{"status": "affected", "version": "4.7.4"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Joomla HikaShop 4.7.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating GET parameters in the product filter endpoint. Attackers can craft malicious URLs containing XSS payloads in the from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials when victims visit the link."}, {"lang": "es", "value": "Joomla HikaShop 4.7.4 contiene una vulnerabilidad de cross-site scripting reflejado que permite a atacantes no autenticados inyectar scripts maliciosos manipulando par\u00e1metros GET en el endpoint del filtro de productos. Los atacantes pueden crear URLs maliciosas que contengan payloads XSS en los par\u00e1metros from_option, from_ctrl, from_task o from_itemid para robar tokens de sesi\u00f3n o credenciales de inicio de sesi\u00f3n cuando las v\u00edctimas visitan el enlace."}], "id": "CVE-2023-54364", "lastModified": "2026-09-26T23:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-54364", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T18:10:40.728994Z", "version": "2.0.3"}}]}, "published": "2026-04-09T21:16:06.117", "references": [{"source": "disclosure@vulncheck.com", "url": "https://demo.hikashop.com/index.php/en/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/51629"}, {"source": "disclosure@vulncheck.com", "url": "https://www.hikashop.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/joomla-hikashop-reflected-xss-via-product-filter"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.7.4"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Joomla HikaShop", "source": "cna", "vendor": "Hikashop"}, "product": "hikashop", "vendor": "hikashop"}], "analysis": {"en": {"generated_at": "2026-04-09T23:07:22.810044+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s patch or upgrade to a version of HikaShop that resolves the reflected XSS flaw.", "If a patch is not yet available, ensure that all values from the from_option, from_ctrl, from_task, and from_itemid parameters are properly sanitized and encoded before rendering them back to the browser.", "Deploy a Content Security Policy that restricts the execution of inline scripts and mitigates the impact of reflected XSS attempts.", "Monitor web server logs for anomalous URLs containing unexpected query parameters to detect potential exploitation attempts."], "summary": {"action": "Apply Patch", "impact": "Reflected Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects any installation of Joomla HikaShop version 4.7.4. Any site running this exact version and using the product filter component is susceptible, regardless of the overall Joomla configuration.", "description_and_impact": "Joomla HikaShop 4.7.4 contains a reflected cross\u2011site scripting flaw that allows attackers to inject malicious scripts by manipulating the GET parameters of the product filter endpoint. By crafting URLs that include XSS payloads in the from_option, from_ctrl, from_task, or from_itemid fields, an unauthenticated attacker can cause the victim\u2019s browser to execute user\u2011supplied code. When a user opens the link, the script can steal session tokens or login credentials, compromising the victim\u2019s account.", "risk_and_exploitability": "With a CVSS score of 5.1 the flaw carries a moderate impact, and the lack of an EPSS score makes the exact exploit probability unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue remotely via a crafted HTTP GET request without needing authentication. The exploit can materialize with any user who clicks the malicious link, potentially leading to credential theft. Due to the absence of a predefined workaround, the risk persists until the vendor releases a patch."}}}}, "created": "2026-04-10T08:38:25.562034+00:00", "updated": "2026-04-10T09:29:10.046514+00:00", "vendors": ["hikashop", "hikashop$PRODUCT$hikashop"]}