$ cve CVE-2009-0730 JSON

CVE-2009-0730 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 1.1% (pctl 64)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in the GigCalendar (com_gigcal) component 1.0 for Mambo and Joomla!, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the gigcal _venues_id parameter in a details action to index.php, which is not properly handled by venuedetails.php, and (2) the gigcal_bands_id parameter in a details action to index.php, which is not properly handled by banddetails.php, different vectors than CVE-2009-0726.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	1.09% — more likely to be exploited than 64% of all CVEs
Weakness	CWE-89
On CISA KEV	no
Public exploit	yes
Published	2009-02-24
Last modified	2026-06-16

Affected (3)

Vendor	Product
gigcalendar	com gigcalendar
joomla	joomla
mambo	mambo

Public exploits

Source	Title	Date
exploit-db	Joomla! / Mambo Component gigCalendar 1.0 - 'banddetails.php' SQL Injection	2009-02-23
exploit-db	Joomla! Component Gigcal 1.x - 'id' SQL Injection	2009-01-18

References

→ the Explorer · watch your stack · NVD