A critical vulnerability in the Joomdonation Events Booking extension for Joomla allows unauthenticated attackers to perform unauthorized file uploads, leading to potential system compromise.

This flaw stems from an insecure default configuration, categorized as CWE-1188, which permits unauthenticated remote users to upload files. By default, the extension fails to restrict media asset uploads, granting external actors the ability to bypass access controls.

The ability for an unauthenticated user to upload arbitrary files poses a severe risk of remote code execution if the attacker uploads executable scripts to the web server. This vulnerability, carrying a CVSS score of 9.8, indicates that the integrity, confidentiality, and availability of the entire Joomla instance are at high risk. Successful exploitation could lead to full site takeover, data exfiltration, or the hosting of malicious content, resulting in significant operational downtime and reputational damage.

Immediate Action: Update the Events Booking extension to version 5.8.0 or later immediately to resolve the insecure default configuration. If an update is not immediately feasible, disable the extension or restrict access to the affected upload functionality at the web server level.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting media upload directories. Monitor for unauthorized file creation events or unexpected changes in the file structure of the Joomla installation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads or anomalous HTTP requests directed at the Joomla extensions directory. Ensure that file upload permissions are strictly enforced via server-level configurations.

Public Exploit Available: No

Given the critical nature of this vulnerability and its potential for unauthenticated remote exploitation, organizations using the Events Booking extension must prioritize this update. Administrators should verify the installation version and apply the patch provided by Joomdonation without delay to mitigate the risk of unauthorized server access.