Executive Summary

This vulnerability occurs in Joomla when using the K2 extension. A user with 'create item' rights (typically an Author tier user) can submit an article containing a raw <script> tag inside the 'embedVideo' POST field.

K2 stores this script tag verbatim and renders it unescaped on the article page, meaning that any visitor to that page will have the script executed in their browser.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in the browsers of visitors to the affected article pages.

• Attackers can steal session cookies or authentication tokens.
• It can be used to deface the website or inject malicious content.
• It may allow attackers to perform actions on behalf of users or redirect them to malicious sites.

Useful 0 Not Useful 0