Security
Vik Booking 1.18.21 fixes stored XSS and CSRF flaws
E4J has released Vik Booking 1.18.21 for Joomla, addressing a medium-severity stored XSS issue involving guest check-in signatures and missing protections on administrative invoice tasks.
Research published by mySites.guru says versions below 1.18.21 are affected. The extension could save an SVG supplied by a guest with a confirmed booking without sanitising its contents. The resulting file was served from the site’s own domain and could execute script when its URL was opened directly.
The release also adds CSRF token and capability checks to invoice generation, re-sending and download tasks. The report rates both issues Medium, with a CVSS 4.0 score of 5.1. No CVE identifiers were assigned to either vulnerability.
The advisory does not report active exploitation. mySites.guru says its findings were not tested against a live site and that no working request is being published.
- Update Vik Booking to
1.18.21. - Enable the new option to keep guest media files outside the web root.
- Review
administrator/components/com_vikbooking/resources/idscans/for existing SVG signature files, and avoid opening suspicious files in a browser.
Administrators running versions below 1.18.17 have missed four security releases identified in the report.
Originally reported by mySites.guru.