CVE-2017-20267: Joomla Calendar Planner SQLi Vulnerability

CVE-2017-20267 Overview

CVE-2017-20267 is an SQL injection vulnerability [CWE-89] in the Joomla! Component Calendar Planner 1.0.1 extension. The flaw exists in the events view, where the category_id parameter is passed to backend database queries without proper sanitization. Unauthenticated attackers can send crafted GET requests containing malicious SQL syntax to extract data from the underlying database. The vulnerability requires no authentication, no user interaction, and is exploitable over the network. A public exploit is documented in Exploit-DB entry 42501, increasing the risk to exposed installations.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents from any Joomla! site running Calendar Planner 1.0.1 by injecting SQL through the category_id parameter.

Affected Products

Joomla! Component Calendar Planner 1.0.1
Joomla! sites with the Calendar Planner extension installed
Distributed via the JoomlaThat resource hub and Joomla! Extensions Directory

Discovery Timeline

2026-06-19 - CVE-2017-20267 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20267

Vulnerability Analysis

The vulnerability resides in the events view of the Calendar Planner component for Joomla!. When a request reaches the events controller, the component reads the category_id query parameter directly from user-supplied input and concatenates it into an SQL statement. Because the parameter is not cast to an integer, escaped, or bound through a parameterized query, an attacker can break out of the intended query context. This permits classic in-band techniques such as UNION-based extraction and boolean-based blind injection. The flaw is reachable through the public-facing site without authentication, expanding the potential attacker pool to anyone on the internet. Refer to the Exploit-DB entry 42501 and the VulnCheck Joomla Advisory for technical specifics.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The Calendar Planner extension trusts the category_id parameter and inserts it into a dynamically built query string. Joomla!'s database abstraction layer supports parameter binding and quoting, but the component does not use these safe APIs for this input path.

Attack Vector

An attacker issues a GET request to the events view URL on a vulnerable Joomla! site and appends SQL payloads to the category_id parameter. The injected statements execute with the privileges of the Joomla! database user, allowing enumeration of tables, extraction of session tokens, user records, password hashes, and configuration data. No credentials, prior access, or user interaction are required.

No verified public code example is reproduced here. See the Exploit-DB entry 42501 for the published proof-of-concept request format.

Detection Methods for CVE-2017-20267

Indicators of Compromise

Web server access logs containing index.php?option=com_calendarplanner requests with SQL keywords such as UNION, SELECT, SLEEP, or -- in the category_id parameter.
Unexpected outbound database errors or HTTP 500 responses correlated with requests to the Calendar Planner events view.
Anomalous read volume against Joomla! tables such as #__users and #__session originating from the web application user.
Presence of new administrator accounts or modified user records following suspicious requests.

Detection Strategies

Deploy web application firewall signatures that flag SQL metacharacters in the category_id query parameter.
Inspect HTTP logs for non-numeric values supplied to category_id, which should always be an integer.
Correlate database error rates and slow queries with requests targeting com_calendarplanner endpoints.
Hunt for chained requests that progressively enumerate schema, table, and column names through information_schema.

Monitoring Recommendations

Enable verbose access logging on the Joomla! web server and forward logs to a centralized analytics platform.
Alert on repeated 4xx or 5xx responses from the Calendar Planner endpoints, which often accompany blind injection probing.
Monitor the Joomla! database user for queries that reference information_schema or unrelated tables.

How to Mitigate CVE-2017-20267

Immediate Actions Required

Disable or uninstall the Calendar Planner 1.0.1 extension from Joomla! until a verified fix is available.
Block requests to index.php?option=com_calendarplanner at the web application firewall if the component cannot be removed immediately.
Rotate database credentials, Joomla! administrator passwords, and session secrets if exploitation is suspected.
Audit #__users and related tables for unauthorized accounts or privilege changes.

Patch Information

No vendor patch is referenced in the NVD data for CVE-2017-20267. Verify the current status of the extension on the Joomla! Extensions Directory listing for Calendar Planner and the JoomlaThat resource hub. If no fixed release is published, treat the extension as end-of-life and remove it.

Workarounds

Remove the com_calendarplanner component directories from the Joomla! installation to eliminate the attack surface.
Add a WAF rule that rejects requests where category_id contains any character other than digits.
Restrict the Joomla! database user to the minimum privileges required, limiting the impact of successful injection.

bash

# Example ModSecurity rule to block non-numeric category_id values
SecRule ARGS:category_id "!@rx ^[0-9]+$" \
    "id:1002017,phase:2,deny,status:403,\
    msg:'CVE-2017-20267 Joomla Calendar Planner SQLi attempt',\
    logdata:'category_id=%{ARGS.category_id}'"