JoomlaUX JUX Real Estate Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in JoomlaUX JUX Real Estate version 3.4.0. The issue arises in an unknown function of the file '/extensions/realestate/index.php/properties/list/list-with-sidebar/realties'. The vulnerability is triggered by manipulating the 'Itemid' and 'jp_yearbuilt' parameters, allowing remote attackers to inject malicious scripts. This exploitation requires user interaction from the victim.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a link containing a crafted URL that includes the 'Itemid' or 'jp_yearbuilt' parameter with a script payload, such as a JavaScript alert. When the victim clicks the link, the injected script will execute, demonstrating the cross-site scripting vulnerability.