An unauthenticated SQL injection vulnerability in the DP Calendar Joomla extension poses a severe risk of unauthorized database access and data exfiltration.

The extension fails to properly sanitize input, leading to an SQL injection vulnerability (CWE-89). This flaw is critical as it allows an unauthenticated attacker to interact directly with the backend database via the web interface.

This vulnerability enables attackers to bypass authentication, read sensitive information from the database, or modify records. Given the high CVSS score of 8.7 and the lack of authentication requirements, this represents a significant threat to the confidentiality and integrity of the Joomla site.

Immediate Action: Update the DP Calendar extension to the latest available version provided by Digital Peak immediately.

Proactive Monitoring: Monitor database query logs for evidence of anomalous SQL syntax or unauthorized enumeration attempts.

Compensating Controls: Utilize a WAF to filter malicious SQL injection payloads from incoming HTTP traffic until the extension can be updated.

Public Exploit Available: No (exploit_available: false)

Site administrators using the DP Calendar extension must verify their version and apply updates immediately. Given that the exploit is unauthenticated, the risk of automated exploitation is high, and patching should be treated as an urgent priority.