CVE-2017-20257: Joomla! Component Quiz Deluxe 3.7.4 SQL Injection
Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the ajaxaction.flagquestion task. Attackers can inject malicious SQL code via the stuquizid or flagquest parameters to manipulate database queries and extract sensitive information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla! Component Quiz Deluxe 3.7.4from your environment.Uninstall the Quiz Deluxe component (version 3.7.4) if it is not required, or disable the component in Joomla until a vendor-supplied fix is available.
- Configuration
Disable or block the ajaxaction.flag_question task in the component configuration or by modifying the component code to prevent processing of that AJAX task (prevent unauthenticated access to stu_quiz_id and flag_quest parameters).
Joomla! Quiz Deluxe component ajaxaction.flag_question = disabled - Compensating control
Apply WAF rules or web server access controls to block or sanitize requests to the Quiz Deluxe AJAX endpoint (specifically requests invoking ajaxaction.flag_question and requests containing stu_quiz_id or flag_quest parameters). Restrict access to the component's AJAX endpoints to trusted IPs where possible.
- Operational
Inspect application and database logs for signs of exploitation or data exfiltration related to the ajaxaction.flag_question task; perform forensic analysis and rotate any credentials or secrets that may have been exposed if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20257?
The severity of CVE-2017-20257 is rated high with a score of 8.8.
What does CVE-2017-20257 exploit?
CVE-2017-20257 exploits an SQL injection vulnerability in the Joomla! Component Quiz Deluxe 3.7.4.
How do I fix CVE-2017-20257?
To fix CVE-2017-20257, update Joomla! Component Quiz Deluxe to a patched version that addresses the SQL injection issue.
What kind of attackers can exploit CVE-2017-20257?
CVE-2017-20257 can be exploited by unauthenticated attackers.
What parameters are affected by CVE-2017-20257?
CVE-2017-20257 is affected by the stu_quiz_id and flag_quest parameters which can be exploited to inject malicious SQL code.