Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-54357— Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration

CVSS 7.5 · High EPSS 0.35% · P27

Possible ATT&CK Techniques 1AI

T1005 · Data from Local System

Affected Version Matrix 1

VendorProductVersion RangeStatus
ArtioJoomla! com_booking component2.4.9affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-54357

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
Source: NVD (National Vulnerability Database)
Vulnerability Description
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过差异性导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
ARTIO Book it 侧信道信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
artio Book it是artio公司的一款适用于运动健身、 wellness、住宿、租车等多种服务行业的在线预约管理系统。 ARTIO Book it 2.4.9版本存在侧信道信息泄露漏洞，该漏洞源于customer控制器中的getUserData函数存在信息泄露问题，未经身份验证的攻击者可通过向index.php发送GET请求，利用option=com_booking、controller=customer、task=getUserData和id参数，通过暴力枚举检索用户名和电子邮件地址。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
ArtioJoomla! com_booking component 2.4.9 -

II. Public POCs for CVE-2023-54357

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-54357

请登录查看更多情报信息。

Exploits & Public PoCs for CVE-2023-54357 (1)

News Coverage for CVE-2023-54357 (1)

Vendor Pages for CVE-2023-54357 (1)

Other References for CVE-2023-54357 (1)

IV. Related Vulnerabilities

Same weakness: CWE-203

V. Comments for CVE-2023-54357

No comments yet

Leave a comment