Joomla com_booking 2.4.9 Information Disclosure via Account Enumeration
Vulnerability Description
Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-54357
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- qw3rTyTy
Affected Vendor
Artio
View all reports →