Vulnerabilities

Conditional Content and Conditional Content Pro, Joomla extensions from Regular Labs, in versions before 8.0.0 accept inline PHP inside Condition Rules article syntax and pass it to their conditions evaluator without checking who authored the article. Because Joomla's normal Author text filter preserves the syntax, any authenticated user with article-authoring rights can embed PHP that runs as the web-server process as soon as the article is published and rendered. This effectively lets an author-level account escalate to full server-side code execution, reflected in a CVSS 4.0 score of 9.4 (critical) with a network attack vector and high privileges required. Sites running Conditional Content or Conditional Content Pro below 8.0.0 are affected. No public proof of concept is known, the issue is not on the CISA KEV list, and there is no evidence of exploitation in the wild.

Do: Upgrade Conditional Content and Conditional Content Pro to version 8.0.0 or later immediately. Until patched, restrict article-authoring rights to trusted users only, and review existing articles' Conditional Content rules for unexpected inline PHP. Audit author accounts and recently published articles for signs of injected code, since any author could have achieved code execution as the web-server user.

SP Property, a real-estate listing extension for Joomla from JoomShaper, contains an unauthenticated SQL injection (CWE-89) in the query builders for its property search and map-filtering features. Search and filter parameters such as zipcode, sorting, price_range_dropdown, and psize_range_dropdown are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, so crafted requests to the search or map endpoints execute attacker-controlled SQL. A remote attacker with no credentials can exploit this via boolean-based or time-based blind SQL injection to extract sensitive data from the Joomla site's database. Any Joomla site running SP Property versions prior to 4.1.4 that exposes the property search or map filtering to visitors is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is not listed in CISA's KEV catalog.

Do: Upgrade SP Property to version 4.1.4 or later. Sites that cannot upgrade immediately should restrict or filter requests to the property search and map-filtering endpoints (the zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters, e.g. via WAF rules) and review web and database logs for slow or anomalous queries consistent with blind SQL injection. Verify the installed version in the Joomla extensions manager.