CVE-2026-78082

SP Property, a real-estate listing extension for Joomla from JoomShaper, contains an unauthenticated SQL injection (CWE-89) in the query builders for its property search and map-filtering features. Search and filter parameters such as zipcode, sorting, price_range_dropdown, and psize_range_dropdown are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, so crafted requests to the search or map endpoints execute attacker-controlled SQL. A remote attacker with no credentials can exploit this via boolean-based or time-based blind SQL injection to extract sensitive data from the Joomla site's database. Any Joomla site running SP Property versions prior to 4.1.4 that exposes the property search or map filtering to visitors is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade SP Property to version 4.1.4 or later. Sites that cannot upgrade immediately should restrict or filter requests to the property search and map-filtering endpoints (the zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters, e.g. via WAF rules) and review web and database logs for slow or anomalous queries consistent with blind SQL injection. Verify the installed version in the Joomla extensions manager.