Exploitation Summary
EIP tracks 3 public exploits for CVE-2008-5874. PoCs published by EcHoLL, Hussin X.
AI-analyzed exploit summary This Perl script exploits a SQL injection vulnerability in the Joomla com_5starhotels component to extract admin credentials (username and password hash) from the jos_users table. It uses a UNION-based SQLi attack via the 'id' parameter in the showhoteldetails task.
Description
Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS) for Joomla! allow remote attackers to execute arbitrary SQL commands via the id parameter in a showhoteldetails action to index.php in the (1) com_allhotels or (2) com_5starhotels module. NOTE: some of these details are obtained from third party information.
Exploits (3)
This Perl script exploits a SQL injection vulnerability in the Joomla com_5starhotels component to extract admin credentials (username and password hash) from the jos_users table. It uses a UNION-based SQLi attack via the 'id' parameter in the showhoteldetails task.
This is a writeup describing a blind SQL injection vulnerability in the Joomla component com_allhotels. It provides example URLs demonstrating the vulnerability but does not include executable exploit code.
This exploit demonstrates a blind SQL injection vulnerability in the Joomla component com_lowcosthotels. The vulnerability allows an attacker to inject malicious SQL queries via the 'id' parameter, enabling information disclosure such as database version extraction.