JEvents SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the JEvents component for Joomla, affecting versions prior to 3.6.88 and 3.6.82.1. The vulnerability arises from the extension's handling of publicly accessible actions that list events by date ranges, allowing for SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.