Joomla iProperty Real Estate 4.1.1 enthält eine reflektierte Cross-Site Scripting (XSS) Schwachstelle, die es Angreifern ermöglicht, bösartige Skripte zu injizieren, indem sie den Parameter filter_keyword manipulieren. Angreifer können URLs erstellen, die JavaScript-Payloads im GET-Parameter filter_keyword des Endpunkts all-properties-with-map enthalten, um beliebigen Code in den Browsern der Opfer auszuführen und Sitzungstoken oder Anmeldeinformationen zu stehlen.

The primary impact of CVE-2023-54361 is the potential for cross-site scripting attacks. An attacker could craft a malicious URL containing a JavaScript payload within the filter_keyword parameter. When a user clicks this link, the injected script executes in their browser within the context of the Joomla iProperty Real Estate website. This allows the attacker to steal session cookies, redirect the user to a phishing site, or deface the website. The blast radius extends to all users who interact with the vulnerable endpoint, particularly those who click on links from untrusted sources. While the vulnerability is reflected, the ease of crafting a malicious URL makes it relatively simple to exploit.

Websites using Joomla iProperty Real Estate version 4.1.1 are at risk. Specifically, sites that rely on user-supplied input within the filter_keyword parameter without proper sanitization are particularly vulnerable. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others.

• joomla / server:

grep -r 'filter_keyword=[^&]*' /var/log/apache2/access.log | grep -i 'javascript:'

• generic web:

curl -I 'https://example.com/all-properties-with-map?filter_keyword=<script>alert(1)</script>' | grep 'Content-Type:'

1. 2026-04-09Disclosure

   disclosure

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-09
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-17

The primary mitigation for CVE-2023-54361 is to upgrade Joomla iProperty Real Estate to a patched version. Unfortunately, the input does not specify a fixed version. Until a patch is available, implement input validation and sanitization on the filterkeyword parameter within the all-properties-with-map endpoint. This should include strict whitelisting of allowed characters and escaping any potentially malicious input. Consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious JavaScript payloads in the filterkeyword parameter. Regularly review and update Joomla and its extensions to ensure you are using the latest security patches.