CVE-2026-14632: Ecommerce-CodeIgniter Open Redirect Flaw

CVE-2026-14632 Overview

CVE-2026-14632 is an open redirect vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap project affecting commits up to 95dfa8cebbb87ab46ae450643a07241274a74dce. The flaw resides in the setReferrer function within application/core/MY_Controller.php, a component of the Trusted Backend Interface. Attackers can manipulate the href argument, which is populated from the HTTP Referer header, to store an arbitrary URL that later renders as a clickable link in the admin orders view. The issue is classified under CWE-601 (URL Redirection to Untrusted Site). The exploit has been publicly disclosed. Because the project uses a rolling release model, no version identifiers are assigned to affected builds.

Critical Impact
Remote attackers can craft requests that inject arbitrary URLs into the referrer session field, enabling phishing pivots when administrators click stored referral links in the backend interface.

Affected Products

kirilkirkov Ecommerce-CodeIgniter-Bootstrap (rolling release, up to commit 95dfa8cebbb87ab46ae450643a07241274a74dce)
Component: Trusted Backend Interface (application/core/MY_Controller.php)
Component: Admin orders view (application/modules/admin/views/ecommerce/orders.php)

Discovery Timeline

2026-07-04 - CVE-2026-14632 published to NVD
2026-07-06 - Last updated in NVD database
Patch commit - 213babdbaa949e94557246414db0130e01394517 published in the upstream repository
Advisory - GHSA-x9pg-hvpj-9q44

Technical Details for CVE-2026-14632

Vulnerability Analysis

The application reads the HTTP_REFERER request header directly and stores the raw value into the user session under the referrer key. The admin backend then renders that stored value as the href attribute of an anchor tag without validation or output encoding. An unauthenticated remote attacker can place any URL scheme or crafted string into the header when triggering a request that reaches setReferrer. When an administrator later views the orders page, the browser presents attacker-controlled links that appear to originate from the trusted admin interface.

Root Cause

The root cause is missing input validation on the Referer header combined with missing output encoding in the orders view. The original code performed no scheme filtering, no length restriction, and no HTML escaping. See the GitHub Security Advisory for full details.

Attack Vector

The attack is network-based and requires user interaction from an administrator who clicks the stored referral link. An attacker sends an HTTP request to any endpoint that invokes setReferrer with a forged Referer header pointing to an attacker-controlled site. The malicious URL is persisted in the session and later rendered in the admin orders panel as a clickable outbound link.

php

// Patch applied in application/core/MY_Controller.php
            if (!isset($_SERVER['HTTP_REFERER'])) {
                $ref = 'Direct';
            } else {
-                $ref = $_SERVER['HTTP_REFERER'];
+                $raw = $_SERVER['HTTP_REFERER'];
+                $parsed = parse_url($raw);
+                $scheme = isset($parsed['scheme']) ? strtolower($parsed['scheme']) : '';
+                if (in_array($scheme, ['http', 'https'], true) && strlen($raw) <= 500) {
+                    $ref = $raw;
+                } else {
+                    $ref = 'Direct';
+                }
            }
            $this->session->set_userdata('referrer', $ref);
        }
// Source: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/213babdbaa949e94557246414db0130e01394517

The patch restricts accepted schemes to http and https, caps the URL length at 500 characters, and adds HTML escaping plus rel="noopener noreferrer" on the anchor tag in the orders view.

Detection Methods for CVE-2026-14632

Indicators of Compromise

HTTP requests containing Referer headers with non-HTTP schemes such as javascript:, data:, or file:.
Session records where the referrer key contains external domains unrelated to legitimate inbound traffic.
Admin orders pages rendering outbound links pointing to unfamiliar or newly registered domains.

Detection Strategies

Inspect web server access logs for requests with abnormally long or malformed Referer header values.
Audit stored session data or database columns that persist referrer values for entries not matching an allowlist of expected inbound sources.
Static analysis of PHP code for direct use of $_SERVER['HTTP_REFERER'] without validation before storage or output.

Monitoring Recommendations

Alert on outbound clicks originating from the admin backend to domains outside the organization's known partner list.
Track anomalies in the volume or distribution of unique referrer values persisted per session.
Correlate administrator authentication events with subsequent navigation to external URLs sourced from the orders view.

How to Mitigate CVE-2026-14632

Immediate Actions Required

Apply upstream patch commit 213babdbaa949e94557246414db0130e01394517 from the project repository.
Clear existing session data containing untrusted referrer values to remove any stored malicious URLs.
Review admin activity logs for interactions with previously rendered referral links.

Patch Information

The fix is applied in commit 213babdbaa949e94557246414db0130e01394517. It validates the Referer scheme against an http/https allowlist, enforces a 500-character maximum length, and applies htmlspecialchars output encoding with rel="noopener noreferrer" on rendered anchors. Because the project follows a rolling release model, integrators should pull the latest main branch or cherry-pick the specific commit.

Workarounds

If patching is not immediately feasible, deploy a web application firewall rule that strips or rejects requests where the Referer header contains schemes other than http or https.
Temporarily disable rendering of the referrer link in application/modules/admin/views/ecommerce/orders.php by displaying the value as plain text with htmlspecialchars and removing the anchor tag.
Restrict administrative backend access to trusted IP ranges to reduce exposure while remediation is planned.

bash

# Example: cherry-pick the upstream security fix into a deployed branch
git fetch origin
git cherry-pick 213babdbaa949e94557246414db0130e01394517
git push origin HEAD

# Verify the patched validation is present
grep -n "parse_url" application/core/MY_Controller.php
grep -n "htmlspecialchars" application/modules/admin/views/ecommerce/orders.php