CVE-2026-78082
CriticalCVSS 9.3Summary
The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.
Risk Assessment
An unauthenticated attacker can extract sensitive data from the database, including user and application data. The vulnerability is easily exploitable remotely and requires no privileges.
Recommendation
Update the SP Property extension to version 4.1.4 or later. Until patched, consider disabling or restricting access to the property search and filtering functionality.
Other vulnerabilities in SP Property
See all- CVE-2026-78085Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains a path traversal vulnerability in the gallery image management controller. The controller tasks lacked directory confinement checks.
- CVE-2026-78303Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 relied on client-submitted hidden fields for recipient routing in booking inquiries. This allowed email destination manipulation and form tampering.
- CVE-2026-78302High
Joomla Extension SP Property versions below 4.1.4 contain an unauthenticated stored cross-site scripting (XSS) vulnerability due to unescaped output in views and admin lists. Multiple template files rendered attributes and text values directly into HTML without contextual escaping.
- CVE-2026-78084Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains missing access control in gallery image management. The controller tasks lacked authorization checks and CSRF token validation, allowing users to invoke file removal actions with arbitrary path strings or upload unverified file types.
- CVE-2026-78083High
Joomla Extension SP Property versions below 4.1.4 lack CSRF token verification in the property booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints. These endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, price_range_dropdown, and psize_range_dropdown) by directly concatenating raw request parameters into SQL strings without quoting or type casting. An unauthenticated remote attacker could execute boolean-based or time-based blind SQL injection to extract sensitive data from the database.