CVE-2017-20260: Joomla! Component Price Alert 3.0.2 SQL Injection
Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the productid parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the productid parameter to extract sensitive database information including credentials and configuration data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the subscribeajax view server-side code to use prepared statements/parameterized queries for the product_id parameter and implement strict input validation/whitelisting (e.g., allow only expected numeric IDs) to prevent SQL injection.
Price Alert 3.0.2 (subscribeajax view) product_id input handling = use parameterized queries and strict input validation (whitelist/validate values) - Compensating control
Block or restrict HTTP access to the Price Alert 3.0.2 subscribeajax view using a WAF, webserver rules, or firewall until the vulnerability is remediated. Implement rules to reject requests that target the subscribeajax endpoint or that include SQL meta-characters in the product_id parameter, or limit access to trusted IPs.
- Operational
Review web and application logs for requests to the subscribeajax view and abnormal product_id parameter usage to detect possible exploitation. If evidence of compromise or data exfiltration is found, rotate any affected database credentials and other potentially exposed secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20260?
The severity of CVE-2017-20260 is rated high with a score of 8.8.
How can I fix CVE-2017-20260?
To fix CVE-2017-20260, upgrade to a version of the Joomla! Component Price Alert that is not affected by the SQL injection vulnerability.
What type of vulnerability is CVE-2017-20260?
CVE-2017-20260 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries.
Who is affected by CVE-2017-20260?
Users of Joomla! Component Price Alert version 3.0.2 are affected by CVE-2017-20260.
What impact can CVE-2017-20260 have on my system?
CVE-2017-20260 could allow unauthorized access to sensitive data by executing arbitrary database queries.