CVE-2009-3357: SQL Injection
Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or comhbssearch) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) hid, (2) id, and (3) rid parameters to longDesc.php, and the hid parameter to (4) detail.php, (5) detail1.php, (6) detail2.php, (7) detail3.php, (8) detail4.php, (9) detail5.php, (10) detail6.php, (11) detail7.php, and (12) detail8.php, different vectors than CVE-2008-5865, CVE-2008-5874, and CVE-2008-5875.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3357?
CVE-2009-3357 is considered a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary SQL commands.
How do I fix CVE-2009-3357?
To fix CVE-2009-3357, update the Hotel Booking Reservation System component to a patched version provided by the vendor.
Which versions of Joomla! are affected by CVE-2009-3357?
CVE-2009-3357 affects versions of the Hotel Booking Reservation System component for Joomla! that are vulnerable specifically to the SQL injection flaws identified.
Can I exploit CVE-2009-3357 to gain unauthorized access?
Yes, exploiting CVE-2009-3357 may allow an attacker to manipulate the database and gain unauthorized access to sensitive data.
What components are affected by CVE-2009-3357?
CVE-2009-3357 affects the Hotel Booking Reservation System (com_hbssearch) component in Joomla!, specifically through multiple SQL injection points.