EUVD-2025-18196CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/U:Amber
Lifecycle Timeline
3Description
A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.
Analysis
Critical unauthenticated SQL injection vulnerability in the JEvents component for Joomla that allows remote attackers to execute arbitrary SQL queries through publicly accessible date range filtering actions. The vulnerability affects JEvents versions before 3.6.88 and 3.6.82.1, enabling attackers to extract sensitive database information, modify data, or potentially achieve remote code execution. With a CVSS score of 9.3 and network-based attack vector requiring no privileges or user interaction, this represents a severe risk to all unpatched Joomla installations using vulnerable JEvents versions.
Technical Context
The JEvents component is a widely-used Joomla extension for event management and calendar functionality. The vulnerability exists in SQL query construction for event listing operations that filter events by date ranges. The root cause falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input from date range parameters is directly concatenated into SQL queries without proper parameterization or escaping. This occurs in publicly accessible actions, meaning the vulnerable code paths do not require authentication. The affected component likely uses direct database queries via Joomla's database API without utilizing prepared statements or parameterized queries, allowing attackers to inject arbitrary SQL syntax through specially crafted date parameters.
Affected Products
The vulnerability affects the JEvents component for Joomla: versions 3.6.82.1 and earlier, and versions 3.6.88 and earlier (indicating a branched version history). CPE representation would be: cpe:2.3:a:joomla:jevents:*:*:*:*:*:joomla:*:* with version constraints <=3.6.82.1 OR <=3.6.88. Any Joomla installation (versions 3.x and potentially 4.x/5.x compatibility) running these vulnerable JEvents versions is affected. The vulnerability is not version-specific to Joomla itself but rather to the third-party component. Organizations should identify all installations via component version checking in Joomla administrator panel or direct file inspection of component manifest files.
Remediation
Immediate actions: (1) Update JEvents component to version 3.6.89 or later (or 3.6.82.2+ if using the 3.6.82.x branch) - obtain from official JEvents website or Joomla Extensions Directory; (2) If immediate patching is not feasible, disable the JEvents component in Joomla administrator panel under Extensions > Manage > Extensions until patching is completed; (3) Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to JEvents date-range parameters; (4) Review database access logs and audit trails for evidence of exploitation (unusual SQL errors, unexpected queries, unauthorized data access) dating back to component deployment; (5) Conduct database integrity verification and restoration from clean backups if exploitation is confirmed; (6) Apply principle of least privilege to Joomla database user accounts to limit damage from successful SQL injection. Vendor advisory and patches should be obtained from official JEvents sources and Joomla security announcements.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today