CVE-2017-20267: Joomla! Component Calendar Planner 1.0.1 SQL Injection
Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the categoryid parameter. Attackers can send GET requests to the events view with malicious SQL code in the categoryid parameter to extract sensitive database information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla! Component Calendar Planner 1.0.1from your environment.Uninstall the Joomla! Component Calendar Planner 1.0.1 from affected Joomla installations if the component is not required.
- Compensating control
If immediate removal is not possible, deploy compensating controls such as a web application firewall rule or reverse-proxy filter to block or sanitize requests to the events view that include the category_id parameter, and/or restrict access to the component (events view) to trusted IPs.
- Operational
Assume potential data exposure: review application and database logs for suspicious activity related to the events view/category_id parameter and rotate database credentials and any other potentially exposed credentials if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20267?
CVE-2017-20267 has a high severity score of 8.2.
How do I fix CVE-2017-20267?
To fix CVE-2017-20267, update to the latest version of Joomla! Component Calendar Planner, which addresses the SQL injection vulnerability.
What types of attacks can be executed through CVE-2017-20267?
CVE-2017-20267 allows unauthenticated attackers to perform SQL injection attacks to extract sensitive data.
Which parameter is exploited in CVE-2017-20267?
The category_id parameter is exploited in CVE-2017-20267 to inject malicious SQL commands.
Can CVE-2017-20267 affect all users of Joomla! Component Calendar Planner?
Yes, CVE-2017-20267 can affect all users of Joomla! Component Calendar Planner version 1.0.1 if they do not apply the necessary updates.