CVE-2009-0730
GigCalendar (com_gigcal) 1.0 - SQL Injection via gigcal_venues_id or gigcal_bands_id Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-0730. PoCs published by Salvatore Fresta, Lanti-Net.
AI-analyzed exploit summary This exploit demonstrates an SQL injection vulnerability in the gigCalendar component for Joomla! and Mambo. It leverages unsanitized user input in the 'gigcal_bands_id' parameter to extract user credentials from the database via a UNION-based attack.
Description
Multiple SQL injection vulnerabilities in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal _venues_id parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcal_bands_id parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.
Exploits (2)
This exploit demonstrates an SQL injection vulnerability in the gigCalendar component for Joomla! and Mambo. It leverages unsanitized user input in the 'gigcal_bands_id' parameter to extract user credentials from the database via a UNION-based attack.
This exploit demonstrates a SQL injection vulnerability in the Joomla Gigcal component. It allows an attacker to extract user credentials from the database via a crafted URL parameter.