Executive brief
The Artio Book it! (com_booking) component for Joomla, which provides reservation and booking functionality, contains a security flaw that exposes user information. An unauthorized person can use this flaw to automatically collect a list of registered users, including their full names, usernames, and email addresses. This information could be used to facilitate targeted phishing attacks or attempts to hijack user accounts.
Technical details
An information disclosure vulnerability exists in the Artio com_booking (Book it!) component for Joomla through version 2.4.9. The flaw is located in the 'getUserData' function within the customer controller, which fails to implement proper access controls. An unauthenticated remote attacker can send crafted GET requests to 'index.php' with specific parameters (option=com_booking, controller=customer, task=getUserData) and iterate through the 'id' parameter. This allows for the brute-force enumeration of the Joomla user database, returning JSON-formatted data containing the 'name', 'username', and 'email' fields for each valid user ID.
Affected products
- Artio com_booking (Book it!) 2.4.9 and earlier
Timeline
- 2023-07-12: other: Exploit author date
- 2023-07-19: disclosed: Exploit published on Exploit-DB
- 2026-06-19: advisory: NVD publication date