CVE-2009-3357

CVSS V2 High 7.5 CVSS V3 None
Description
Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) h_id, (2) id, and (3) rid parameters to longDesc.php, and the h_id parameter to (4) detail.php, (5) detail1.php, (6) detail2.php, (7) detail3.php, (8) detail4.php, (9) detail5.php, (10) detail6.php, (11) detail7.php, and (12) detail8.php, different vectors than CVE-2008-5865, CVE-2008-5874, and CVE-2008-5875.
Overview
  • CVE ID
  • CVE-2009-3357
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-09-24T16:30:02
  • Last Modified Date
  • 2018-10-10T19:43:28
Weakness Enumerations
CWE URL
CWE-89 http://cwe.mitre.org/data/definitions/89.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:joomla:joomla:*:*:*:*:*:*:*:* 0 OR
cpe:2.3:a:joomlahbs:com_hbssearch:*:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 7.5
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
http://secunia.com/advisories/33215 Vendor Advisory
http://e-rdc.org/v1/news.php?readmore=142 Exploit
http://www.securityfocus.com/bid/36380 Exploit
http://www.exploit-db.com/exploits/9648
http://www.securityfocus.com/archive/1/506444/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-3357
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3357
History
Created Old Value New Value Data Type Notes
2022-05-10 18:32:17 Added to TrackCVE