HikaShop (com_hikashop) below 6.5.2 - Unauthenticated Open Redirect

HikaShop versions before 6.5.2 carry an open redirect in the currency switcher (CVE-2026-61901). A crafted link using a doubly encoded return address sends the visitor off to an external website once the currency is changed, and no login is needed to use it. The vendor rates it medium severity. The value of it to an attacker is that the link starts on your domain, so it lends your reputation to whatever phishing or malware page it lands on, and it will pass any filter that trusts your site. HikaShop 6.5.2, released 20 July 2026, now decodes and validates the return address before redirecting so only addresses on your own site are accepted. Update to 6.5.2 or later. There is no setting you can change to close this off, so patching is the only fix. Also covered by this rule: CVE-2023-38044 (SQL injection, 4.0.0-4.7.2), CVE-2024-40746 (stored XSS via product description, below 5.1.1), CVE-2025-22210 (authenticated SQL injection in backend category management, 3.3.0-5.1.4) and CVE-2025-25225 (administrator to Super Admin privilege escalation, 1.0.0-5.1.3). Also within this rule: CVE-2023-54364 (HikaShop 4.7.4 reflected XSS) and CVE-2015-7344 (HikaShop below 2.6.0 XSS via an injected payload[/caption]). Both sit below this ceiling and need no separate row.

Affected versions: < 6.5.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

How CVE-2025-25225 is scored

The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

The rule below is rated Low for the set of 6 CVEs it covers together, not for this record on its own.

Affected extensions and versions