CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles.
Explanation of Vulnerability in Simple Terms
DP Calendar extension for Joomla contains a SQL injection vulnerability in versions 5.5.0-10.11.2. An attacker with high-level privileges can inject malicious SQL commands to read sensitive data from the site database. The vulnerability requires administrative or elevated account access to exploit.
What an attacker can do
Read sensitive data from the site database by injecting SQL commands.
Potential impact on your site
A compromised admin account could expose user data, settings, and other database contents.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent account) on the Joomla site.
Key dates
External resources
Related vulnerabilities
