XSS in Ecommerce-CodeIgniter-Bootstrap via Hidden API

Executive Summary

CVE-2026-14633 is a vulnerability in the Ecommerce-CodeIgniter-Bootstrap application involving a hidden REST API endpoint that allows anonymous users to create product records without authentication.

The vulnerability arises because the API accepts and stores attacker-controlled HTML or JavaScript code in product fields such as title and description without proper sanitization.

When these malicious product entries are later displayed on the frontend product pages, the injected scripts execute in the browsers of users viewing those pages, resulting in a stored Cross-Site Scripting (XSS) attack.

The attack can be carried out remotely by sending a POST request with malicious payloads to the hidden endpoint `/index.php/api/product/set`.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to inject malicious scripts into product data that is displayed to users.

Such scripts can execute in the browsers of your users, potentially leading to session theft, Cross-Site Request Forgery (CSRF) attacks, phishing, or other malicious activities.

Because the API does not require authentication, attackers can create or delete products without permission, which can compromise the integrity of your product data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unauthorized POST requests to the hidden REST API endpoint `/index.php/api/product/set` that create product records without authentication.

You can monitor network traffic or server logs for POST requests to this endpoint containing suspicious or unexpected data in the title or description fields.

A simple command to detect such attempts in web server logs (e.g., Apache or Nginx) could be:

• grep "/index.php/api/product/set" /var/log/apache2/access.log | grep POST

Additionally, inspecting the database for unexpected or malicious HTML/JavaScript content in product titles or descriptions can help identify exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include deploying the patch that enforces authentication checks on the vulnerable API endpoints.

Specifically, ensure that the `set_post()` and `productDel_delete()` functions in the `Api/Products.php` controller require a valid admin session before processing requests, which prevents unauthenticated product creation or deletion.

Also, apply proper output encoding such as using `htmlspecialchars()` on user-supplied data in templates to prevent stored cross-site scripting.

If immediate patching is not possible, consider restricting access to the `/index.php/api/product/set` endpoint via network controls or web application firewall rules to block unauthorized requests.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to create product records with malicious scripts that execute stored cross-site scripting (XSS) attacks on users visiting the affected product pages. This can lead to session theft, cross-site request forgery (CSRF), and phishing attacks against victims.

Such security weaknesses can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of user data and secure handling of personal information. The exploitation of this vulnerability could lead to unauthorized access or compromise of user sessions and data, potentially violating data protection and privacy requirements.

Therefore, failure to patch this vulnerability may result in non-compliance with these regulations due to inadequate security controls against injection and authentication bypass vulnerabilities.

Useful 0 Not Useful 0