Collected research
Joomla: PHP Bug Introduces Multiple XSS Vulnerabilities
Multiple cross-site scripting vulnerabilities in Joomla (CVE-2024-21726) are traced to divergent handling of invalid UTF-8 by two PHP mbstring functions: mb_strpos restarts parsing at an invalid byte while mb_substr skips continuation bytes, so the index and the extraction disagree. Joomla's tag-stripping filter uses both, and inserted invalid sequences shift the offset past an opening angle bracket, leaving arbitrary HTML in the output.
Record
- Researcher
- Stefan Schiller
- Published by
- Sonar
- Date
- Topic
- XSS
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Stefan Schiller, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .