CVE-2017-20268
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Joomla! Component Zap Calendar Lite version 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads to extract sensitive database information.
Risk Assessment
This vulnerability poses a serious risk to organizations by allowing attackers access to sensitive database information, potentially leading to further attacks or data breaches.
Recommendation
It is recommended to update the Zap Calendar Lite component to the latest version to mitigate this vulnerability and implement appropriate security measures such as input filtering and validation.
Original NVD description (English source)
Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads to extract sensitive database information including database names and table structures.