The SP Property extension for Joomla contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise sensitive database information.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). Unauthenticated attackers can inject malicious SQL code through parameters such as zipcode, sorting, price_range_dropdown, and psize_range_dropdown, which are concatenated directly into database queries without proper validation or type casting.

The ability for an unauthenticated attacker to perform blind SQL injection poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the unauthorized exfiltration of sensitive site data, including user credentials or property records, and potentially allow for the modification of backend database contents. Given the CVSS score of 9.3, this vulnerability is classified as critical and represents an urgent threat to business continuity and data protection.

Immediate Action: Update the JoomShaper SP Property extension to version 4.1.4 or later immediately. If a patch is not yet available for your specific deployment, disable the affected property search and map filtering features until a secure version can be installed.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors, specifically looking for time-based or boolean-based blind injection indicators. Review web server access logs for requests containing suspicious SQL keywords or characters directed at the extension search endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection patterns in incoming HTTP requests. Ensure that database service accounts are restricted to the minimum necessary privileges to limit the potential blast radius of an injection attack.

Public Exploit Available: Unknown

This vulnerability presents a critical risk due to its accessibility to unauthenticated remote attackers. Organizations utilizing the SP Property extension must prioritize updating to version 4.1.4 as soon as the vendor makes the patch available. Failure to address this flaw could result in a complete compromise of the database layer, necessitating immediate attention from security and IT operations teams.