Alex Joseph
A significant security flaw has been discovered in the ARTIO Book It! component for Joomla, specifically version 2.4.9. This vulnerability, identified as CVE-2023-54357, is an information disclosure issue that could allow malicious actors to quietly collect sensitive user data from your website. This means that details like usernames, full names, and email addresses could be exposed without requiring any authentication.
CVE Details
This vulnerability impacts the ARTIO Book It! component, which is a popular booking and reservation system for Joomla-powered websites.
- Product: ARTIO Book It! (Joomla com_booking component)
- Published: June 19, 2026
- Severity: High
- Status: Analyzed
Affected Products
The vulnerability primarily affects installations running ARTIO Book It! component version 2.4.9. If your Joomla website uses this specific version of the booking component, it is at risk.
Current Status
The vulnerability has been thoroughly analyzed and publicly disclosed. As of October 28, 2026, website administrators and developers using ARTIO Book It! 2.4.9 should be aware of this risk and take appropriate action. It is crucial to check for official updates or advisories from ARTIO.
Severity Level
Rated with a High severity (CVSS score 7.5), this information disclosure vulnerability poses a considerable threat. Its high rating is due to the ease with which it can be exploited by unauthenticated attackers. They can use simple GET requests to enumerate user accounts, potentially leading to a large-scale data harvest. Such an incident can severely compromise user privacy and set the stage for more targeted attacks like phishing or identity theft.
Possible Solutions
To mitigate the risk associated with CVE-2023-54357, site administrators should prioritize updating their ARTIO Book It! component. While specific patch details weren’t immediately available through the primary vendor site during our research, the general recommendation for such vulnerabilities is:
- Update Immediately: Check the official ARTIO website and their download section for any new versions of the “Book It!” component. Upgrading to the latest secure version is typically the most effective defense.
- Monitor for Suspicious Activity: Keep an eye on your server logs for unusual GET requests to
index.phpinvolvingoption=com_booking,controller=customer, andtask=getUserData, especially with varyingidparameters. - Implement Stronger Access Controls: Where possible, review and enhance access control policies to restrict unauthorized access to user data functions.
For the most accurate and up-to-date solutions, always refer to the official ARTIO documentation, their support forums, or contact their support team directly.
References
http://www.artio.net/
http://www.artio.net/downloads/joomla/book-it/book-it-2-free/download
https://www.exploit-db.com/exploits/51595
https://www.vulncheck.com/advisories/joomla-com-booking-information-disclosure-via-account-enumeration
