CVE-2026-78083
HighCVSS 7.1Summary
Joomla Extension SP Property versions below 4.1.4 lack CSRF token verification in the property booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints. These endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.
Risk Assessment
Missing CSRF token verification allows an attacker to force a logged-in user to perform unwanted actions, such as booking or sending messages.
Recommendation
Update the SP Property extension to version 4.1.4 or later, which includes anti-CSRF token verification.
Other vulnerabilities in SP Property
See all- CVE-2026-78085Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains a path traversal vulnerability in the gallery image management controller. The controller tasks lacked directory confinement checks.
- CVE-2026-78303Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 relied on client-submitted hidden fields for recipient routing in booking inquiries. This allowed email destination manipulation and form tampering.
- CVE-2026-78302High
Joomla Extension SP Property versions below 4.1.4 contain an unauthenticated stored cross-site scripting (XSS) vulnerability due to unescaped output in views and admin lists. Multiple template files rendered attributes and text values directly into HTML without contextual escaping.
- CVE-2026-78084Medium
The Joomla SP Property extension (joomshaper.com) in versions below 4.1.4 contains missing access control in gallery image management. The controller tasks lacked authorization checks and CSRF token validation, allowing users to invoke file removal actions with arbitrary path strings or upload unverified file types.
- CVE-2026-78082Critical
The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.
Original NVD description (English source)
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.