CVE-2009-0380: SQL Injection
DISPUTED SQL injection vulnerability in the Sigsiu Online Business Index 2 (SOBI2, comsobi2) RC 2.8.2 component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the bid parameter in a showbiz action to index.php, a different vector than CVE-2008-0607. NOTE: CVE disputes this issue, since neither "showbiz" nor "bid" appears in the source code for SOBI2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0380?
The severity of CVE-2009-0380 is disputed, but it is categorized as an SQL injection vulnerability that can lead to the execution of arbitrary SQL commands.
How can I fix CVE-2009-0380?
To fix CVE-2009-0380, it's recommended to update the Sigsiu Online Business Index (SOBI2) to a patched version or apply security patches that address this vulnerability.
What software is affected by CVE-2009-0380?
CVE-2009-0380 specifically affects the Sigsiu Online Business Index 2 (SOBI2) version 2.8.2-rc component used in Joomla! and Mambo.
Can CVE-2009-0380 be exploited remotely?
Yes, CVE-2009-0380 can be exploited remotely by attackers to execute SQL commands through the bid parameter.
Is there a known workaround for CVE-2009-0380?
Currently, the most effective workaround for CVE-2009-0380 is to avoid using the vulnerable component until an official fix is applied.