CVE-2026-14634: Ecommerce-CodeIgniter-Bootstrap XSS Flaw

CVE-2026-14634 Overview

CVE-2026-14634 is a stored cross-site scripting (XSS) vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap project up to commit 213babdbaa949e94557246414db0130e01394517. The flaw resides in the checkForPostRequests function of application/core/MY_Controller.php, which handles newsletter subscription requests. Unsanitized User-Agent header content is persisted to storage and later rendered in the Subscribed Emails admin page. Attackers can inject arbitrary script that executes in the browser of any administrator viewing the subscriber list. The project uses a rolling release model, so no fixed version is published; the corrective patch is identified as commit 23105f25dadf57b4314fc015a63a7c6e910c89df. A public exploit exists, and the weakness maps to [CWE-79].

Critical Impact
Remote unauthenticated attackers can store JavaScript through the User-Agent HTTP header, which executes in the administrator's session context when the Subscribed Emails page is viewed.

Affected Products

kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 213babdbaa949e94557246414db0130e01394517
Component: Subscribed Emails Admin Page (application/core/MY_Controller.php)
Component: Admin view application/modules/admin/views/settings/emails.php

Discovery Timeline

2026-07-04 - CVE-2026-14634 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14634

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in a PHP CodeIgniter e-commerce application. The subscription handler reads the raw HTTP_USER_AGENT request header and inserts it into the database alongside the subscriber's email and IP address. When an administrator opens the Subscribed Emails page, the stored browser field is echoed directly into HTML without encoding. Any script tags or event handlers embedded in the attacker-controlled User-Agent string execute inside the administrator's authenticated session. Successful exploitation can lead to session token theft, forced administrative actions, or pivoting deeper into the admin panel. The public availability of exploitation details lowers the barrier to attack.

Root Cause

The root cause is missing output encoding and missing input sanitization on data sourced from an HTTP header attackers fully control. The browser value written by checkForPostRequests was stored verbatim, and the admin view emitted the field with a raw <?= $email->browser ?> expression. Neither the storage path nor the render path applied htmlspecialchars or equivalent contextual escaping, satisfying every precondition for [CWE-79].

Attack Vector

An unauthenticated remote attacker sends a POST request to the newsletter subscription endpoint that includes the subscribeEmail parameter and a crafted User-Agent header containing an XSS payload. The payload is stored in the subscribers table. Exploitation completes when a privileged administrator navigates to the Subscribed Emails admin page, at which point the payload renders and executes in the administrator's browser. User interaction from the victim admin is required.

php

// Vulnerable sink prior to patch — application/core/MY_Controller.php
// Attacker-controlled header written to storage without sanitization
$arr['browser'] = $_SERVER['HTTP_USER_AGENT'];

// Vulnerable rendering prior to patch — admin/views/settings/emails.php
// Stored value emitted without HTML encoding
// <td><?= $email->browser ?></td>

Source: GitHub Commit Overview

Detection Methods for CVE-2026-14634

Indicators of Compromise

Newsletter subscription requests where the User-Agent header contains HTML tags, <script>, on*= event handlers, or javascript: URIs.
Rows in the newsletter subscribers table where the browser column contains angle brackets, quote characters, or encoded script fragments.
Administrator browser sessions issuing unexpected outbound requests immediately after loading the Subscribed Emails page.
Web server access logs showing subscription POST requests from anonymous sources with malformed or oversized User-Agent strings.

Detection Strategies

Query the subscribers table for values in browser that do not match a well-formed User-Agent pattern.
Deploy a web application firewall rule that inspects the User-Agent header on subscription endpoints for XSS signatures.
Enforce Content Security Policy (CSP) reporting on admin pages to surface script execution attempts from stored payloads.

Monitoring Recommendations

Alert on administrator sessions loading /admin/settings/emails followed by anomalous XHR or fetch activity.
Monitor for repeated subscription submissions from the same source with varying User-Agent values.
Retain full HTTP request headers in application logs to support retrospective hunts for stored payloads.

How to Mitigate CVE-2026-14634

Immediate Actions Required

Apply the upstream patch at commit 23105f25dadf57b4314fc015a63a7c6e910c89df to both application/core/MY_Controller.php and application/modules/admin/views/settings/emails.php.
Audit the subscribers table and purge any rows whose browser field contains HTML or script content.
Rotate administrator session cookies and credentials if any suspicious rows were rendered in the admin panel.
Restrict access to the admin interface with network-level controls until the patch is deployed.

Patch Information

The maintainer published a fix as commit 23105f25dadf57b4314fc015a63a7c6e910c89df. The patch strips HTML tags and truncates the header at storage time using substr(strip_tags($_SERVER['HTTP_USER_AGENT']), 0, 500) and applies htmlspecialchars($value, ENT_QUOTES, 'UTF-8') when rendering email, browser, and ip in the admin view. See the GitHub Security Advisory and VulDB CVE-2026-14634 entry for details.

php

// Patched storage — application/core/MY_Controller.php
$arr['browser'] = substr(strip_tags($_SERVER['HTTP_USER_AGENT']), 0, 500);

// Patched rendering — application/modules/admin/views/settings/emails.php
// <td><?= htmlspecialchars($email->email,   ENT_QUOTES, 'UTF-8') ?></td>
// <td><?= htmlspecialchars($email->browser, ENT_QUOTES, 'UTF-8') ?></td>
// <td><?= htmlspecialchars($email->ip,      ENT_QUOTES, 'UTF-8') ?></td>