CyberRota Analysis
AI-GeneratedThe SP Property extension for Joomla versions prior to 4.1.4 is vulnerable to unauthenticated SQL injection due to improper handling of user input in property search and filtering queries. This flaw allows remote attackers to execute malicious SQL queries, potentially leading to the extraction of sensitive data from the database. Organizations using this extension should prioritize immediate patching to mitigate the risk of data breaches.
Original NVD Description
Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses (zipcode, sorting, price_range_dropdown, and psize_range_dropdown) by directly concatenating raw request parameters into SQL strings without quoting or type casting. An unauthenticated remote attacker could execute boolean-based or time-based blind SQL injection to extract sensitive data from the database.