Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-54357— Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration

Quick assessment

Affected
Artio Joomla! com_booking component
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

artio Book it是artio公司的一款适用于运动健身、 wellness、住宿、租车等多种服务行业的在线预约管理系统。 ARTIO Book it 2.4.9版本存在侧信道信息泄露漏洞，该漏洞源于customer控制器中的getUserData函数存在信息泄露问题，未经身份验证的攻击者可通过向index.php发送GET请求，利用option=com_booking、controller=customer、task=getUserData和id参数，通过暴力枚举检索用户名和电子邮件地址。

CVSS 7.5 · High EPSS 0.66% · P51

Possible ATT&CK Techniques 1 AI

T1005 · Data from Local System

Affected Version Matrix 1

VendorProduct Version RangeStatus
Artio Joomla! com_booking component 2.4.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-54357

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过差异性导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
ARTIO Book it 侧信道信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
artio Book it是artio公司的一款适用于运动健身、 wellness、住宿、租车等多种服务行业的在线预约管理系统。 ARTIO Book it 2.4.9版本存在侧信道信息泄露漏洞，该漏洞源于customer控制器中的getUserData函数存在信息泄露问题，未经身份验证的攻击者可通过向index.php发送GET请求，利用option=com_booking、controller=customer、task=getUserData和id参数，通过暴力枚举检索用户名和电子邮件地址。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Artio Joomla! com_booking component 2.4.9 -

II. Public POCs for CVE-2023-54357

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-54357

请登录查看更多情报信息。

Exploits & Public PoCs for CVE-2023-54357 (1)

News Coverage for CVE-2023-54357 (1)

Vendor Pages for CVE-2023-54357 (1)

Other References for CVE-2023-54357 (1)

IV. Related Vulnerabilities

Same weakness: CWE-203

V. Comments for CVE-2023-54357

No comments yet

Leave a comment