CVE-2023-54357: Joomla com_booking Information Disclosure

CVE-2023-54357 Overview

CVE-2023-54357 is an information disclosure vulnerability in the Joomla com_booking component version 2.4.9, developed by Artio. The flaw resides in the getUserData function within the customer controller. Unauthenticated attackers can send crafted GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve sensitive user account data. The exposed data includes user names, usernames, and email addresses. Attackers can brute-force the id parameter to enumerate the entire customer database. The vulnerability is classified under [CWE-203] (Observable Discrepancy).

Critical Impact
Unauthenticated remote attackers can enumerate all user accounts on affected Joomla sites, harvesting names, usernames, and email addresses for targeted phishing and credential-stuffing campaigns.

Affected Products

Artio Joomla com_booking component version 2.4.9
Joomla installations using the Book-It extension by Artio
Web applications integrating the vulnerable customer controller endpoint

Discovery Timeline

2026-06-19 - CVE-2023-54357 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2023-54357

Vulnerability Analysis

The com_booking extension exposes a getUserData task in the customer controller without enforcing authentication or authorization checks. An attacker reaches the endpoint through Joomla's standard component routing using index.php?option=com_booking&controller=customer&task=getUserData&id=<numeric>. The server responds with structured user data tied to the supplied identifier. Because the id parameter accepts sequential integers, attackers iterate through values to harvest the full user roster. The disclosed fields include personally identifiable information that supports follow-on social engineering and account takeover attacks.

Root Cause

The root cause is missing access control on a sensitive data-returning endpoint. The getUserData task in the customer controller does not verify that the requester owns the targeted account or holds administrative privileges. The handler trusts the client-supplied id parameter and returns user profile data without session validation, token checks, or rate limiting. This pattern aligns with [CWE-203] where observable behavior of the application reveals information that should remain protected.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker issues HTTP GET requests directly to the public Joomla endpoint. By scripting incrementing values of the id parameter, the attacker enumerates user records at high speed. The technique requires only a list of target sites running the vulnerable component and a basic HTTP client. A public proof of concept is documented in Exploit-DB #51595 and the VulnCheck Joomla Advisory.

The vulnerability manifests in the getUserData function of the customer controller. See the referenced advisories for technical reproduction details.

Detection Methods for CVE-2023-54357

Indicators of Compromise

HTTP GET requests to index.php containing the parameter combination option=com_booking, controller=customer, and task=getUserData
High-volume sequential requests against the id parameter from a single source IP or distributed botnet
Web server access logs showing 200 OK responses to enumeration patterns targeting customer data endpoints

Detection Strategies

Deploy web application firewall rules that flag requests containing task=getUserData against com_booking from unauthenticated sessions
Correlate access logs for sequential id parameter values within short time windows to identify enumeration attempts
Alert on outbound responses to getUserData requests that exceed normal baseline volumes

Monitoring Recommendations

Forward Joomla and reverse proxy access logs to a centralized log analytics platform for query-based hunting
Monitor for spikes in 200 OK responses tied to the com_booking component path
Track source IP reputation and geolocation diversity against the getUserData endpoint to identify distributed scraping

How to Mitigate CVE-2023-54357

Immediate Actions Required

Disable or uninstall the Artio com_booking 2.4.9 extension until a vendor-supplied patch is verified
Block external access to the task=getUserData endpoint at the web application firewall or reverse proxy layer
Audit web server logs for prior enumeration activity and notify affected users if their data was disclosed

Patch Information

No vendor patch information is referenced in the published advisory. Administrators should consult the Artio Main Website and the Artio Joomla Download page for updated releases. The VulnCheck Joomla Advisory should be monitored for remediation guidance.

Workarounds

Add a WAF rule that denies any HTTP request matching option=com_booking&controller=customer&task=getUserData
Restrict access to the com_booking administrative routes to authenticated sessions only via .htaccess or equivalent server-level controls
Apply rate limiting on the Joomla index.php endpoint to slow enumeration attempts against the id parameter

bash

# Example Apache mod_rewrite rule to block the vulnerable endpoint
RewriteEngine On
RewriteCond %{QUERY_STRING} option=com_booking [NC]
RewriteCond %{QUERY_STRING} controller=customer [NC]
RewriteCond %{QUERY_STRING} task=getUserData [NC]
RewriteRule ^index\.php$ - [F,L]