Security
Vik extensions receive fixes for CSRF and stored XSS
E4J has released security updates for three Joomla extensions, addressing a CSRF weakness and stored cross-site scripting in Vik Booking, Vik Rent Car and Vik Rent Items.
Research published by mySites.guru covers Vik Booking 1.18.19, Vik Rent Car 1.15.13 and Vik Rent Items 1.8.6. Versions below those releases are affected. The Vik Booking update is the extension’s third security release in seven days.
- The CSRF issue affects information-request forms in Vik Booking and Vik Rent Car. The forms lacked token validation and did not enforce disabled contact-request settings. The assessed severity is Medium, with a CVSS 4.0 score of
6.9; the reported impact is unwanted emails, not data exposure. - The stored XSS issue affects custom-field names and popup links across all three extensions. An administrator-level user would need to place the script in a field before it could run for visitors on a confirmation page. mySites.guru assessed this as Medium, with a CVSS 4.0 score of
4.8.
No CVE identifiers were assigned. The research says it did not test the issues against a live site and does not publish a working request. Administrators should update all installed Vik extensions to the fixed versions and review custom-field names and links for unexpected content.
Originally reported by mySites.guru.