CVE-2017-20272: Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id
Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the sfselectuserid parameter. Attackers can send GET requests to index.php with the option=comupl and view=propertylisting parameters to extract sensitive database information including table names and column structures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla Ultimate Property Listing 1.0.2from your environment.Uninstall the Ultimate Property Listing extension from the Joomla instance if it is not required.
- Configuration
Disable the 'Ultimate Property Listing' extension in the Joomla Extensions Manager to prevent access to the vulnerable functionality (requests using option=com_upl and view=propertylisting).
Joomla Ultimate Property Listing enabled = false - Compensating control
At the network edge or WAF, block or filter HTTP requests that include the parameters 'option=com_upl' and 'view=propertylisting' or the 'sf_selectuser_id' parameter. Alternatively restrict access to these endpoints to trusted IPs only.
- Operational
If exploitation is suspected, review web and database logs for malicious queries and indicators of compromise, and rotate any database credentials or other secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20272?
The severity of CVE-2017-20272 is high with a score of 8.8.
How do I fix CVE-2017-20272?
To fix CVE-2017-20272, update Joomla Ultimate Property Listing to the latest version that addresses this SQL injection vulnerability.
What does CVE-2017-20272 affect?
CVE-2017-20272 affects Joomla Ultimate Property Listing version 1.0.2.
What type of vulnerability is CVE-2017-20272?
CVE-2017-20272 is an SQL injection vulnerability.
Can unauthorized users exploit CVE-2017-20272?
Yes, CVE-2017-20272 can be exploited by unauthenticated attackers.