CVE-2009-0730: SQL Injection
Multiple SQL injection vulnerabilities in the GigCalendar (comgigcal) component 1.0 for Mambo and Joomla!, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal venuesid parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcalbandsid parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable magic_quotes_gpc by setting magic_quotes_gpc = On in your php.ini so that input escaping is applied (mitigates SQL injection in GigCalendar com_gigcal 1.0 when magic_quotes_gpc is disabled).
PHP magic_quotes_gpc = On
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0730?
CVE-2009-0730 is considered a critical vulnerability due to its potential for remote SQL injection attacks.
How do I fix CVE-2009-0730?
To fix CVE-2009-0730, ensure that magic_quotes_gpc is enabled and consider upgrading to a patched version of the GigCalendar component.
What software is affected by CVE-2009-0730?
CVE-2009-0730 specifically affects the GigCalendar component version 1.0 used in Mambo and Joomla! when magic_quotes_gpc is disabled.
Can CVE-2009-0730 be exploited remotely?
Yes, CVE-2009-0730 can be exploited remotely, allowing attackers to execute arbitrary SQL commands.
What are the potential impacts of CVE-2009-0730?
The potential impacts of CVE-2009-0730 include unauthorized data access, data manipulation, and complete database takeover.