Real Estate Manager Free Extension For Joomla
Monthly
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Reflected cross-site scripting in the ordasoft.com Real Estate Manager (Free) extension for Joomla before version 6.7.9 lets remote attackers execute arbitrary script in a victim's browser by luring them to a crafted URL. The flaw lives in the 'leave a review' form on the public property-detail page, where the review title is echoed from the request straight into a double-quoted HTML attribute with no escaping or filtering at all - a double-quote character in the title parameter breaks out of the attribute and permits a following <script> element to run. No authentication is required and the CVSS 4.0 base score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); exploitation depends on the victim loading the malicious link, so it is not self-triggering, and no public exploit code was identified at time of analysis. Impact is contained to the tricked user's browser session, with no server-side compromise; this is a genuine but low-severity issue.
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Reflected cross-site scripting in the ordasoft.com Real Estate Manager (Free) extension for Joomla before version 6.7.9 lets remote attackers execute arbitrary script in a victim's browser by luring them to a crafted URL. The flaw lives in the 'leave a review' form on the public property-detail page, where the review title is echoed from the request straight into a double-quoted HTML attribute with no escaping or filtering at all - a double-quote character in the title parameter breaks out of the attribute and permits a following <script> element to run. No authentication is required and the CVSS 4.0 base score is 5.3 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N); exploitation depends on the victim loading the malicious link, so it is not self-triggering, and no public exploit code was identified at time of analysis. Impact is contained to the tricked user's browser session, with no server-side compromise; this is a genuine but low-severity issue.