Joomla Solidres Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Joomla Solidres version 2.13.3. This vulnerability allows unauthenticated attackers to inject malicious scripts by manipulating various GET parameters, including show, reviews, type_id, distance, facilities, categories, prices, location, and Itemid. Attackers can craft URLs with JavaScript payloads in these parameters, potentially stealing session tokens, login credentials, or altering site content when victims click on the links.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a link containing a crafted URL with a JavaScript payload inserted into one of the vulnerable GET parameters. When the victim clicks the link, the injected script will execute, demonstrating the cross-site scripting vulnerability.