Joomla Solidres 2.13.3 enthält eine reflektierte Cross-Site Scripting (XSS) Schwachstelle, die es nicht authentifizierten Angreifern ermöglicht, bösartige Skripte einzuschleusen, indem sie mehrere GET-Parameter wie show, reviews, type_id, distance, facilities, categories, prices, location und Itemid manipulieren. Angreifer können bösartige URLs erstellen, die JavaScript-Payloads in diesen Parametern enthalten, um Session-Token, Login-Anmeldeinformationen zu stehlen oder den Seiteninhalt zu manipulieren, wenn Opfer die erstellten Links besuchen.

The XSS vulnerability in Joomla Solidres 2.13.3 is particularly concerning because it is unauthenticated, meaning an attacker doesn't need valid credentials to exploit it. They can craft malicious URLs containing JavaScript payloads within GET parameters like 'show', 'reviews', 'type_id', 'distance', 'facilities', 'categories', 'prices', 'location', and 'Itemid'. When a user clicks on this crafted link, the injected script executes in their browser context, allowing the attacker to steal their session cookies, potentially gaining access to their account. Furthermore, the attacker could inject scripts to modify the content displayed on the page, potentially leading to phishing attacks or defacement. The blast radius extends to all users who interact with vulnerable pages, especially those who click on links shared through external channels.

Websites using Joomla CMS with the Solidres extension installed, particularly those with public-facing forms or search functionalities that rely on GET parameters. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromised website could potentially be used to attack other websites on the same server.

• joomla / wordpress: Review access logs for GET requests containing unusual or suspicious JavaScript code in parameters like 'show', 'reviews', 'type_id', 'distance', 'facilities', 'categories', 'prices', 'location', and 'Itemid'.

 grep -i 'javascript:' /var/log/apache2/access.log |
 grep 'solidres'

• generic web: Use curl to test various GET parameters with JavaScript payloads and observe the response for signs of script execution.

curl 'https://example.com/solidres/?show=<script>alert("XSS")</script>'

• generic web: Examine response headers for unexpected Content-Security-Policy (CSP) directives that might be bypassed by the XSS vulnerability.

curl -I https://example.com/solidres/

1. 2026-04-09Disclosure

   disclosure

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-09
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-17

The primary mitigation for CVE-2023-54363 is to upgrade Joomla Solidres to a patched version as soon as it becomes available. Until a patch is released, consider implementing input validation and output encoding on the affected GET parameters to sanitize user-supplied data. Web Application Firewalls (WAFs) can be configured with rules to detect and block malicious requests containing suspicious JavaScript payloads in the GET parameters. Regularly review and update Joomla and Solidres installations to ensure they are running the latest security patches. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload through the affected GET parameters and verifying that it is properly sanitized.