CVE-2017-20268: Joomla Zap Calendar Lite SQLi Flaw

CVE-2017-20268 Overview

CVE-2017-20268 is an SQL injection vulnerability [CWE-89] in the Joomla! component Zap Calendar Lite version 4.3.4. The flaw resides in the RSVP plugin endpoint, where the eid parameter is concatenated into a database query without proper sanitization. Unauthenticated attackers can submit crafted GET requests to extract database names, table structures, and other sensitive data. The vulnerability requires no privileges or user interaction and is reachable over the network.

Critical Impact
Unauthenticated remote attackers can exfiltrate sensitive database contents from any Joomla! site running Zap Calendar Lite 4.3.4 by injecting SQL payloads through the eid parameter.

Affected Products

Joomla! Component Zap Calendar Lite 4.3.4
Joomla! sites with the Zap Calendar Lite RSVP plugin enabled
ZContent extension distribution channel

Discovery Timeline

2026-06-19 - CVE-2017-20268 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2017-20268

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw classified under [CWE-89]. The Zap Calendar Lite RSVP plugin accepts an eid parameter via HTTP GET requests and uses its value directly in a backend SQL query. Because the input is not validated, escaped, or bound as a parameter, attackers can append SQL clauses such as UNION SELECT statements to extract arbitrary data from the underlying database. Exploitation requires no authentication, which makes any internet-exposed Joomla! installation running the affected component a viable target. Public exploitation details are documented in Exploit-DB #42500 and the VulnCheck Joomla Advisory.

Root Cause

The RSVP plugin passes the user-controlled eid query string parameter into a SQL statement without parameterized queries or input filtering. Joomla!'s database abstraction layer offers prepared statements and escaping helpers, but the affected component does not use them for this parameter. The result is direct query concatenation, the canonical pattern leading to SQL injection.

Attack Vector

The attacker issues an HTTP GET request to the RSVP plugin endpoint with a crafted eid value containing SQL payloads. Because the request requires no session, cookies, or CSRF tokens, the attack can be automated at scale against Joomla! sites identified through search engine fingerprinting. Successful exploitation enables enumeration of database schemas, extraction of user credentials stored in the Joomla! users table, and disclosure of session tokens or configuration data.

No verified exploit code is reproduced here. See the Exploit-DB advisory for the public proof-of-concept payload structure.

Detection Methods for CVE-2017-20268

Indicators of Compromise

HTTP GET requests targeting the Zap Calendar RSVP plugin endpoint containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the eid parameter.
Unusual response sizes or response time deviations from the RSVP plugin endpoint suggesting blind or union-based extraction.
Web server access logs showing repeated requests with incrementing or encoded eid values from a single source IP.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the eid parameter for SQL metacharacters and reserved keywords before requests reach the Joomla! application.
Enable database query logging on the Joomla! MySQL instance and alert on queries originating from the Zap Calendar component that contain UNION SELECT or schema enumeration patterns.
Correlate web server logs with database error logs to identify failed injection attempts that surface SQL syntax errors.

Monitoring Recommendations

Baseline normal traffic patterns to the RSVP plugin and alert on deviations in request volume, parameter length, or character distribution.
Monitor outbound data transfer volumes from the database server to detect bulk extraction following successful exploitation.
Track Joomla! component inventories and flag any installation of Zap Calendar Lite at version 4.3.4 or earlier.

How to Mitigate CVE-2017-20268

Immediate Actions Required

Disable or uninstall the Zap Calendar Lite component from any Joomla! installation running version 4.3.4 until a fixed release is verified.
Restrict access to the Joomla! /index.php endpoints that route to the RSVP plugin using firewall or reverse proxy rules.
Audit the Joomla! users table and session table for indicators of credential or token theft, and rotate any exposed secrets.

Patch Information

No vendor patch is referenced in the available advisory data. Administrators should consult the Joomla! Extension Directory listing and the ZContent project site for current release information and migrate to a supported version if available.

Workarounds

Place a WAF in front of the Joomla! site with signatures that block SQL injection patterns in the eid query parameter.
Apply virtual patching through reverse proxy rewrite rules that reject requests containing non-numeric values for eid.
Remove the RSVP feature directory from the Joomla! plugins folder to prevent the vulnerable code path from being reachable.

bash

# Example Nginx rule to reject non-numeric eid values
location /index.php {
    if ($arg_eid !~ "^[0-9]+$") {
        return 403;
    }
}