CVE-2009-0730
Joomla! / Mambo Component gigCalendar 1.0 - 'banddetails.php' SQL Injection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
Multiple SQL injection vulnerabilities in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal _venues_id parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcal_bands_id parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.
Múltiples vulnerabilidades de inyección SQL en el componente GigCalendar (com_gigcal) v1.0 para Mambo y Joomla!, cuando magic_quotes_gpc está deshabilitado, permite a atacantes remotos ejecutar comandos SQL de su elección a través de (1) el parámetro gigcal _venues_id en una acción details para index.php, que no es manejada adecuadamente por venuedetails.php y (2) el parámetro gigcal_bands_id parameter en una acción details para index.php, que no es manejada adecuadamente por banddetails.php. Se trata de vectores diferentes de CVE-2009-0726.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-01-18 First Exploit
- 2009-02-24 CVE Reserved
- 2009-02-24 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/501174/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/archive/1/501175/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/archive/1/501176/100/0/threaded | Mailing List | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/48865 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/32807 | 2009-02-23 | |
| https://www.exploit-db.com/exploits/7815 | 2009-01-18 | |
| http://www.securityfocus.com/bid/33859 | 2024-08-07 | |
| http://www.securityfocus.com/bid/33863 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Gigcalendar Search vendor "Gigcalendar" | Com Gigcalendar Search vendor "Gigcalendar" for product "Com Gigcalendar" | 1.0 Search vendor "Gigcalendar" for product "Com Gigcalendar" and version "1.0" | - |
Affected
| in | Joomla Search vendor "Joomla" | Joomla Search vendor "Joomla" for product "Joomla" | * | - |
Safe
|
| Gigcalendar Search vendor "Gigcalendar" | Com Gigcalendar Search vendor "Gigcalendar" for product "Com Gigcalendar" | 1.0 Search vendor "Gigcalendar" for product "Com Gigcalendar" and version "1.0" | - |
Affected
| in | Mambo Search vendor "Mambo" | Mambo Search vendor "Mambo" for product "Mambo" | * | - |
Safe
|