Executive brief
Jomres is a booking and property management system for the Joomla content management platform. A security flaw allows an attacker to trick a logged-in user into unknowingly changing their own account details, such as their password or email address. This could lead to unauthorized account takeover if a user visits a malicious website while logged into their Jomres account.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Jomres component (version 9.11.2) for Joomla. The application fails to validate unique tokens on requests sent to the 'account/index' endpoint. An attacker can exploit this by crafting a malicious HTML page containing a hidden form that automatically submits POST requests to the vulnerable endpoint. If an authenticated user visits this malicious page, the attacker can silently modify the user's profile details, including their password, email address, and contact information, without their consent. This vulnerability requires the victim to be authenticated and to interact with a malicious link or site.
Affected products
- Jomres Jomres 9.11.2
Timeline
- 2018-06-15: disclosed: Initial exploit discovery by L0RD
- 2018-06-18: other: Exploit published on Exploit-DB
- 2026-05-23: advisory: CVE published/updated in NVD