Joomla JLex Review 6.0.1 enthält eine reflektierte Cross-Site Scripting (XSS) Schwachstelle, die es Angreifern ermöglicht, bösartige Skripte zu injizieren, indem sie den review_id URL-Parameter manipulieren. Angreifer können bösartige Links mit JavaScript-Payloads erstellen, die ausgeführt werden, wenn sie in den Browsern von Opfern angeklickt werden, was Session-Hijacking oder Credential-Diebstahl ermöglicht.

The primary impact of CVE-2023-54360 is the potential for attackers to execute arbitrary JavaScript code within the context of a user's browser session. This can be achieved by crafting malicious URLs containing JavaScript payloads and enticing users to click them. Once executed, the attacker can steal session cookies, redirect users to phishing sites, or deface the website. The blast radius extends to any user who interacts with the vulnerable page, particularly those who click on specially crafted links. While the vulnerability is reflected, meaning it requires user interaction, the ease of crafting and distributing malicious links makes it a significant risk, especially on sites with high traffic or user engagement.

Websites using Joomla CMS with the JLex Review component installed, particularly those with user-generated content or review systems, are at risk. Sites with weak input validation or inadequate security practices are especially vulnerable. Shared hosting environments where multiple websites share the same server resources are also at increased risk.

• joomla / server:

grep -r 'review_id=[^&]*' /var/log/apache2/access.log | grep -i 'javascript:'

• generic web:

curl -I 'https://example.com/?review_id=<script>alert(1)</script>' | grep 'Content-Type:'

1. 2026-04-09Disclosure

   disclosure

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-09
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-17

The primary mitigation for CVE-2023-54360 is to upgrade Joomla JLex Review to a patched version. Unfortunately, the specific fixed version is not provided in the input. Until a patch is available, consider implementing input validation and sanitization on the reviewid parameter to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS attempts can also provide a layer of protection. Carefully review and sanitize any user-supplied data before rendering it in HTML. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into the reviewid parameter and verifying that it is not executed.