PT-2009-3349 · Mambo Joomla · Gigcalendar

Published 2009-02-24 · Updated 2018-10-10 · CVE-2009-0730

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GigCalendar (com gigcal) component version 1.0 for Mambo and Joomla!

Description The issue allows remote attackers to execute arbitrary SQL commands when magic quotes gpc is disabled. This is possible via the gigcal venues id parameter in a details action to "index.php", which is not properly handled by venuedetails.php, and the gigcal bands id parameter in a details action to "index.php", which is not properly handled by banddetails.php.

Recommendations For GigCalendar (com gigcal) component version 1.0, consider disabling the parameters gigcal venues id and gigcal bands id in the affected API endpoints until a patch is available. Restrict access to the venuedetails.php and banddetails.php files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2009-0730

Affected Products

Gigcalendar

References · 9

• 🔥 https://exploit-db.com/exploits/32807 · Exploit
• 🔥 http://securityfocus.com/bid/33863 · Exploit
• 🔥 https://exploit-db.com/exploits/7815 · Exploit
• 🔥 http://securityfocus.com/bid/33859 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0730 · Security Note
• http://securityfocus.com/archive/1/501175/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48865 · Note
• http://securityfocus.com/archive/1/501176/100/0/threaded · Note
• http://securityfocus.com/archive/1/501174/100/0/threaded · Note