CVE-2026-14634: User-Agent XSS in Ecommerce-CodeIgniter-Bootstrap Admin Panel

Technical summary

The vulnerability resides in the checkForPostRequests function within application/core/MY_Controller.php. The component fails to properly sanitize the User-Agent header before reflecting it in responses to the Subscribed Emails Admin Page. This classic reflected XSS flaw (CWE-79) allows crafted requests to execute arbitrary JavaScript in a victim administrator's session. The affected version extends up to commit 213babdbaa949e94557246414db0130e01394517. Because the project uses continuous delivery without discrete versioning, the patch commit hash 23105f25dadf57b4314fc015a63a7c6e910c89df should be verified as the remediation point in the source repository.

Business impact

Admin accounts using this ecommerce platform face session hijacking, unauthorized configuration changes, and potential customer data exposure through account compromise. While direct data loss or system outage is unlikely, an attacker could modify email subscription settings, redirect communications, or escalate privileges within the application. For organizations relying on this CodeIgniter-based store, this represents an insider-threat vector if admins browse untrusted links or if attacker-controlled referrers inject the payload.

Affected systems

The kirilkirkov Ecommerce-CodeIgniter-Bootstrap project is affected up to commit 213babdbaa949e94557246414db0130e01394517. The component Subscribed Emails Admin Page is the primary attack surface. Because this project follows a rolling release model without traditional versioning, affected installations are those that have not yet pulled the patch commit 23105f25dadf57b4314fc015a63a7c6e910c89df or later from the repository. Any environment with this codebase deployed to a version prior to the patch is vulnerable.

Exploitability

Exploitability is moderate to high in practice. The vulnerability requires no authentication to craft the malicious request, but does require user interaction—specifically, an administrator must access the page with the attacker-controlled User-Agent header. Public exploit code is available, removing the barrier to weaponization. A realistic attack vector includes phishing an admin with a specially crafted link or embedding a malicious User-Agent in a referrer. The low complexity and remote attack surface make this practical for opportunistic adversaries targeting ecommerce platforms.

Remediation

Apply the patch identified by commit hash 23105f25dadf57b4314fc015a63a7c6e910c89df. Because this project uses continuous delivery, update your local copy to include this commit or any version beyond it. The fix likely involves proper input validation and output encoding of the User-Agent header in the checkForPostRequests function and anywhere user-supplied headers are reflected. Verify the patch against the project's source repository (typically GitHub for open-source CodeIgniter projects) before deploying to production.

Patch guidance

Fetch the latest code from the kirilkirkov Ecommerce-CodeIgniter-Bootstrap repository and verify that commit 23105f25dadf57b4314fc015a63a7c6e910c89df or a later commit is present in your branch. If your codebase is pinned to an older state, cherry-pick this commit or pull the latest main/master branch. Test the patch in a staging environment to ensure the Subscribed Emails Admin Page functions correctly and that User-Agent headers are no longer reflected in HTML responses without encoding. Perform a code review of the MY_Controller.php file to confirm that all header inputs are sanitized consistently across the application.

Detection guidance

Monitor HTTP logs for User-Agent headers containing script tags (e.g., <script>, javascript:, onerror=, onload=) directed at paths containing 'email' or 'admin' and the MY_Controller endpoint. Implement Web Application Firewall (WAF) rules to block or alert on User-Agent payloads matching common XSS patterns. On the application side, enable verbose logging of admin page access and correlate anomalous User-Agent values with admin session activity. Endpoint Detection and Response (EDR) tools should flag unexpected JavaScript execution in browsers used by administrative staff.

Why prioritize this

This vulnerability merits prompt patching within 30 days despite its CVSS 4.3 medium score. The public availability of exploit code and the practical ease of exploitation combine with the attack surface (admin interfaces) and business impact (account compromise) to elevate real-world risk. Organizations operating ecommerce sites cannot tolerate admin account takeover. The rolling-release model also means that unpatched instances persist indefinitely unless actively updated—creating a long tail of vulnerable deployments.

Risk score, explained

The CVSS 4.3 medium severity reflects the limited scope (integrity only, no confidentiality or availability loss) and the requirement for user interaction. However, the actual risk is amplified by public exploitability, targeting of high-privilege accounts (admins), and the nature of open-source rolling-release adoption patterns. A busy security team should weight this as high-priority for admin-facing systems, even though the numerical CVSS is medium.

Frequently asked questions