PT-2026-51003 · Artio · Joomla! Com Booking

Qw3Rtyty · Published 2026-06-19 · Updated 2026-06-19 · CVE-2023-54357

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Joomla com booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses through brute force enumeration.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2023-54357

Affected Products

Joomla! Com Booking

References · 5

• 🔥 https://exploit-db.com/exploits/51595 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-54357 · Security Note
• https://vulncheck.com/advisories/joomla-com-booking-information-disclosure-via-account-enumeration · Note
• http://artio.net · Note
• http://artio.net/downloads/joomla/book-it/book-it-2-free/download · Note