CVE-2017-20253: Joomla! Component My Projects 2.0 SQL Injection
Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
joomla/my-projectsfrom your environment.Uninstall or disable the 'My Projects' Joomla component (version 2.0) from affected sites until a vendor-supplied security update is available.
- Compensating control
Restrict or block access to the vulnerable component endpoint that accepts the VerAyari parameter using network controls (firewall/ACL) or a web application firewall; deploy WAF rules to detect and block SQL injection payloads targeting this endpoint.
- Operational
Assume possible data exposure: review web and database logs for suspicious queries or access patterns to the component, and rotate database credentials and any other credentials that may have been exposed if exploitation is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20253?
The severity of CVE-2017-20253 is rated as high with a score of 8.2.
What type of vulnerability is CVE-2017-20253?
CVE-2017-20253 is an SQL injection vulnerability found in the Joomla! Component My Projects 2.0.
Who can exploit CVE-2017-20253?
CVE-2017-20253 can be exploited by unauthenticated attackers.
How do I fix CVE-2017-20253?
To fix CVE-2017-20253, ensure that you update the Joomla! Component My Projects to a version that addresses this SQL injection vulnerability.
What does CVE-2017-20253 allow attackers to do?
CVE-2017-20253 allows attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter.