CVE-2026-78082: Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, pricerangedropdown, and psizerangedropdown) by directly concatenating raw request parameters into SQL strings without quoting or type casting. An unauthenticated remote attacker could execute boolean-based or time-based blind SQL injection to extract sensitive data from the database.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it through the property search and listing functionality. No account or prior authentication is required.
Which inputs are involved in the vulnerable query building?
The affected query builders concatenate raw request parameters for zipcode, sorting, price_range_dropdown, and psize_range_dropdown into WHERE and ORDER BY SQL clauses.
What could an attacker do with successful exploitation?
The issue supports boolean-based or time-based blind SQL injection, which can be used to extract sensitive data from the database.
Which versions are affected?
SP Property versions earlier than 4.1.4 are affected.