Executive brief
DP Calendar is a popular Joomla event management extension used to create and manage calendars and booking systems on websites. An authenticated user with article update permissions can exploit a blind SQL injection vulnerability when saving an article that triggers the content plugin, potentially allowing an attacker to read or modify database contents without direct visibility of query results.
Technical details
A blind SQL injection vulnerability exists in DP Calendar versions 5.5.0 through 10.11.2 in the content plugin that is triggered during article save operations. The vulnerability requires an authenticated attacker with article update/create permissions on the target Joomla site. The injection occurs through unsanitized user input that is passed into a SQL query without proper parameterization. Since it is a blind SQL injection, an attacker cannot see query results directly but can infer data through time-based or boolean-based techniques by observing response differences. An attacker can leverage this to extract sensitive data from the database or potentially modify records. Patched versions are available and users should update to the latest version of DP Calendar.
Affected products
- Digital Peak DP Calendar 5.5.0 to 10.11.2
Timeline
- 2026-08-28: disclosed