Security
StageIt updates fix CSRF and PHP injection risks
Joomla staging extension StageIt has received security updates addressing CSRF flaws and a settings-file issue that could enable PHP execution.
mySites.guru reports that StageIt, developed by Barnaby V. Dixon of php-web-design.com, lacked Joomla security-token checks for actions including pushes, restores, removals, backup deletion and Options saves. A crafted page visited by a logged-in administrator could therefore trigger those actions.
The more serious attack chain involved an Options value containing an apostrophe escaping into params.php as PHP. mySites.guru rates this combination 8.6 High under CVSS 4.0. No CVE has been published, and the researchers say they did not build or test the exploit paths.
StageIt 5.xis affected below5.8.0.StageIt 6.xis affected below6.4.0.- The releases also address backup path handling, two XSS paths and unauthorised disabling of the StageIt bar.
Administrators should update Joomla 5 installations to 5.8.0 and Joomla 6 installations to 6.4.0, then verify the installed version. They should also review StageIt logs and backups for unexpected activity, and remove the extension and staging copy if no longer needed.
Originally reported by mySites.guru.