tagline: Confidence in the Connected World
CIS Logo
HomeResourcesAdvisoriesA Vulnerability in Joomla! Could Allow for SQL Injection

A Vulnerability in Joomla! Could Allow for SQL Injection

MS-ISAC ADVISORY NUMBER:

2017-048

DATE(S) ISSUED:

05/18/2017

OVERVIEW:

A vulnerability has been discovered in Joomla!, which could allow for SQL Injection. Joomla! is an open source content management system for websites. Successful exploitation of this vulnerability could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

THREAT INTELLIGENCE:

There are currently no reports of this vulnerability being exploited in the wild.

May 22 - UPDATED THREAT INTELLIGENCE
Proof of Concept code has been publicly released for this vulnerability.

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: MEDIUM
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: MEDIUM
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in Joomla!, which could allow for SQL injection. This vulnerability exists due to inadequate filtering of request data in URL parameters. An attacker can exploit this issue by manipulating the SQL query logic in the URL bar in order to run SQL queries on the underlying database. (CVE-2017-8917)

Successful exploitation of this vulnerably could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

RECOMENDATIONS:

We recommend the following actions be taken:

  • Apply appropriate patches provided by Joomla! to vulnerable systems immediately after appropriate testing.
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Protect Your Systems from Cyber Threats Like This

CIS Controls That Help Avoid This Issue Arrow CIS Control 13: Data Protection Arrow CIS Control 18: Application Software Security