CVE-2026-67365 in iCagenda Extension
Summary
by MITRE • 08/14/2026
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability affects the iCagenda Joomla extension version 4.0.0 through 4.0.11 and represents a critical unauthenticated sql injection flaw that can be exploited without requiring any valid session tokens or user credentials. The vulnerability exists within the mod_icagenda_calendar module component and is reachable through the com_ajax interface, which allows attackers to execute arbitrary sql commands against the underlying database. The flaw stems from insufficient input validation and sanitization of user-supplied parameters passed to the sql query execution functions, creating a direct path for malicious sql payloads to be interpreted and executed by the database engine. This type of vulnerability falls under the CWE-89 category for sql injection attacks, which is classified as a common weakness in web application security frameworks.
The operational impact of this vulnerability is severe as it allows remote attackers to perform unauthorized data access, modification, or deletion operations on the target system's database. Attackers can extract sensitive information including user credentials, personal data, and administrative details from the database without needing any authentication. The vulnerability is particularly dangerous because it operates through the com_ajax interface which is commonly used for asynchronous content loading in joomla extensions, making it an attractive target for exploitation. This attack vector enables attackers to escalate privileges and potentially gain full control over the affected joomla installation, as demonstrated by the ATT&CK framework's technique T1078 for valid accounts and T1213 for data from information repositories.
Security practitioners should immediately implement mitigations including upgrading to iCagenda version 4.0.12 or later where this vulnerability has been patched, applying web application firewalls with sql injection detection rules, and implementing input validation controls at the application level. The patch addresses the specific parameter handling issue by implementing proper sql escaping and parameterized queries that prevent malicious payloads from being executed as database commands. Organizations should also conduct thorough security assessments of their joomla installations to identify any other potentially vulnerable extensions or components that might be susceptible to similar attacks, particularly those using ajax interfaces or direct database query methods without proper sanitization controls. The vulnerability demonstrates the importance of following secure coding practices and implementing defense-in-depth strategies as outlined in the owasp top ten project's recommendations for preventing sql injection attacks through proper input validation and output encoding mechanisms.