Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allow…

Description

Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) h_id, (2) id, and (3) rid parameters to longDesc.php, and the h_id parameter to (4) detail.php, (5) detail1.php, (6) detail2.php, (7) detail3.php, (8) detail4.php, (9) detail5.php, (10) detail6.php, (11) detail7.php, and (12) detail8.php, different vectors than CVE-2008-5865, CVE-2008-5874, and CVE-2008-5875.

Scores

EPSS (exploitation in 30 days)

1.0% · top 36% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a
• CWE-89 (opens in a new tab)All about CWE-89 and its CVEs

Affected products

• n/a

  • affected n/a

References (5)

• 33215 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 9648 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
• 36380 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• http://e-rdc.org/v1/news.php?readmore=142 (opens in a new tab)x_refsource_MISCx_transferred
• 20090914 [ECHO_ADV_111$2009] Joomla Hotel Booking System Component XSS/SQL Injection Multiple Vulnerability (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2009-3357](https://trackcve.app/badge/CVE-2009-3357.svg)](https://trackcve.app/cve/CVE-2009-3357)

Record last updated 7 Aug 2024, 06:22 UTC.