CVE-2017-20275: Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter
Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=comphpbridge&view=phpview parameters and inject SQL code in the id parameter to extract database information including table and column names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla! Component PHP-Bridge 1.2.3from your environment.Uninstall the PHP-Bridge component (version 1.2.3) from affected Joomla installations if the component is not required.
- Configuration
Disable the phpview functionality or require authentication/administrative access for requests to index.php?option=com_phpbridge&view=phpview to prevent unauthenticated use of the id parameter.
Joomla! Component PHP-Bridge com_phpbridge view=phpview access = disabled or restrict to authenticated/admin users - Compensating control
Deploy WAF rules or firewall access controls to block SQL injection attempts targeting index.php?option=com_phpbridge&view=phpview and the id parameter; restrict access to the component to trusted IP addresses where possible.
- Operational
Search web and database logs for requests to index.php?option=com_phpbridge&view=phpview (including suspicious id parameter values). If exploitation is suspected, assume possible data exposure, rotate affected database credentials, and restore services from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20275?
CVE-2017-20275 has a severity rating of high with a score of 8.8.
What type of vulnerability is associated with CVE-2017-20275?
CVE-2017-20275 is an SQL injection vulnerability affecting the Joomla! Component PHP-Bridge 1.2.3.
How do I fix CVE-2017-20275?
To fix CVE-2017-20275, update the Joomla! Component PHP-Bridge to a version that does not contain this vulnerability.
What can attackers do with CVE-2017-20275?
Attackers can exploit CVE-2017-20275 to execute arbitrary SQL queries by injecting malicious code through the id parameter.
Is authentication required to exploit CVE-2017-20275?
No, exploitation of CVE-2017-20275 does not require authentication, allowing unauthenticated attackers to execute the attack.