CVE-2017-20260: Joomla! Component Price Alert 3.0.2 SQL Injection

Published Jun 19, 2026

Updated

Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the productid parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the productid parameter to extract sensitive database information including credentials and configuration data.

Affected Software

2 affected components

Joomla! Price Alert (Joomla component)=3.0.2

Weborange Price Alert Joomla\!=3.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Joomla! Price Alert 3.0.2 to a version that resolves this vulnerability.
Fixed in 3.0.2

Event History

Jun 19, 2026

CVE Published

via MITRE·03:44 PM

Data Sourced

via MITRE·03:44 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-20260?

The severity of CVE-2017-20260 is rated high with a score of 8.8.

How can I fix CVE-2017-20260?

To fix CVE-2017-20260, upgrade to a version of the Joomla! Component Price Alert that is not affected by the SQL injection vulnerability.

What type of vulnerability is CVE-2017-20260?

CVE-2017-20260 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries.

Who is affected by CVE-2017-20260?

Users of Joomla! Component Price Alert version 3.0.2 are affected by CVE-2017-20260.

What impact can CVE-2017-20260 have on my system?

CVE-2017-20260 could allow unauthorized access to sensitive data by executing arbitrary database queries.