A crafted href parameter supplied to the Trusted Backend setReferrer function causes the application to perform an open redirect to an arbitrary URL. The flaw, identified as CWE‑601, is remotely exploitable; an attacker can embed a malicious link that, when clicked, will redirect a user’s browser to a phishing or malicious site without any authentication requirement.

Deployments of the kirilkirkov Ecommerce‑CodeIgniter‑Bootstrap project that include the Trusted Backend feature and contain code up to and including commit 95dfa8cebbb87ab46ae450643a07241274a74dce are affected. Because the repository follows a rolling‑release model without numbered releases, administrators must verify the commit hash of the deployed code; any deployment that does not incorporate the fixing commit 213babdbaa949e94557246414db0130e01394517 remains vulnerable. The vulnerable component resides in application/core/MY_Controller.php and is part of the Trusted Backend Interface.

The CVSS score of 5.3 indicates moderate severity, driven by the remote nature of the attack and the potential for deceptive redirects. The EPSS score of less than 1% suggests a low current likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Because no authentication is required, an attacker can trigger the redirect by directing any user to a crafted URL, facilitating phishing or malicious content delivery. The impact is confined to user‑browser redirection and does not compromise system data or integrity directly.