CVE-2008-5494: SQL injection vulnerability in the Contact Information Module (com_contactinfo) component 1.0 for Joomla!

Security readout for executives and security teams

CVE-2008-5494 is a remote SQL injection issue in Joomla's Contact Information Module component com_contactinfo 1.0. If that component is installed and reachable, an attacker could manipulate database queries through the catid parameter. The sources do not provide CVSS, confirmed patch details, or evidence of current active exploitation. Exposure is most likely on legacy Joomla sites that installed com_contactinfo 1.0 and still expose the affected index.php route. The source bundle lists affected vendor and product fields as n/a, so inventory validation should rely on component presence rather than CPE matching. Prioritize if any public legacy Joomla site still runs com_contactinfo 1.0. The business risk is database compromise from an old web component. If the component is absent, the practical risk is low for that environment. Mitigation focus: Identify and remove unused com_contactinfo installations.; Check vendor or maintainer guidance for fixed versions or replacement components.; Restrict access to legacy Joomla administration and vulnerable public routes where possible..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.