CVE-2017-20270: Joomla! Component Twitch Tv 1.1 SQL Injection
Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username and id parameters. Attackers can send GET requests to index.php with option=comtwitchtv and view parameters containing SQL injection payloads to extract sensitive database information including credentials and configuration data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the Twitch Tv component in the Joomla administrator interface (Extensions → Manage → Manage) to prevent access to index.php?option=com_twitchtv until a vendor patch or remediation is available.
Twitch Tv 1.1 (Joomla component) enabled = false - Compensating control
Deploy WAF or webserver rules to block or filter HTTP requests targeting index.php where the query parameter option=com_twitchtv. Additionally, create rules to block or sanitize requests containing username or id parameters with SQL metacharacters (e.g., quotes, semicolons, comment tokens), or restrict access to the component's endpoints to trusted IP addresses only.
- Operational
Assume sensitive database information (including credentials and configuration data) may have been exposed. Rotate database credentials used by Joomla and any secrets referenced by the Twitch Tv component, invalidate/recreate affected keys, and review server and database logs for unauthorized queries or other signs of compromise.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20270?
CVE-2017-20270 has a high severity score of 8.8.
How do I fix CVE-2017-20270?
To fix CVE-2017-20270, update the Joomla! Component Twitch Tv to a version that addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2017-20270?
CVE-2017-20270 is an SQL injection vulnerability.
Can CVE-2017-20270 be exploited by unauthenticated users?
Yes, CVE-2017-20270 can be exploited by unauthenticated attackers.
Which parameters are affected by CVE-2017-20270?
CVE-2017-20270 affects the username and id parameters in requests to the Joomla! Component Twitch Tv.