CVE-2017-20281: Joomla! Component Extra Search 2.2.8 SQL Injection
Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the establename parameter. Attackers can send GET requests to index.php with the option=comextrasearch parameter and malicious SQL in the establename field to extract sensitive database information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla! Component Extra Searchfrom your environment.Uninstall the Extra Search component (com_extrasearch) from the Joomla installation if it is not required.
- Configuration
Disable the Extra Search (com_extrasearch) component in the Joomla administrator interface to stop it handling requests to index.php?option=com_extrasearch.
Joomla! (com_extrasearch) enabled = false - Compensating control
Deploy a WAF rule or firewall ACL to block or inspect GET requests to index.php with option=com_extrasearch and the establename parameter (e.g., block requests containing SQL metacharacters in establename). Alternatively restrict access to the component to trusted management IPs only.
- Operational
Review web server and application logs for requests to index.php?option=com_extrasearch and the establename parameter, and investigate any signs of SQL injection or data exfiltration.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20281?
The severity of CVE-2017-20281 is rated high with a score of 8.2.
How do I fix CVE-2017-20281?
To fix CVE-2017-20281, update Joomla! Component Extra Search to a version that addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2017-20281?
CVE-2017-20281 is an SQL injection vulnerability affecting Joomla! Component Extra Search.
Who is affected by CVE-2017-20281?
Unauthenticated attackers can exploit CVE-2017-20281 to manipulate database queries.
What parameters are involved in the exploitation of CVE-2017-20281?
The exploitation of CVE-2017-20281 involves the establename parameter in GET requests with the option=com_extrasearch.