CVE-2017-15946
📋 TL;DR
This is a critical SQL injection vulnerability in Joomla!'s com_tag component that allows attackers to execute arbitrary SQL commands through the 'tag' parameter. It affects Joomla! websites running com_tag component version 1.7.6. Attackers can exploit this without authentication via GET requests.
💻 Affected Systems
- Joomla! com_tag component
📦 What is this software?
Tag Meta by Selfget
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, remote code execution, and full system takeover.
Likely Case
Database information disclosure, data manipulation, and potential administrative access to the Joomla! installation.
If Mitigated
Limited impact with proper input validation and database permissions, but still significant risk.
🎯 Exploit Status
Simple GET request exploitation with publicly available proof-of-concept code. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to com_tag component version 1.7.7 or later
Vendor Advisory: https://www.joomla.org/announcements/release-news/5824-joomla-3-8-2-and-3-7-5-security-releases.html
Restart Required: No
Instructions:
1. Update Joomla! to version 3.8.2 or 3.7.5. 2. Update com_tag component to version 1.7.7 or later via Joomla! Extension Manager. 3. Clear Joomla! cache after update.
🔧 Temporary Workarounds
Input Validation Filter
allAdd custom input validation for the 'tag' parameter to filter SQL injection attempts
Implement parameterized queries or input sanitization in affected PHP files
Web Application Firewall Rule
allBlock SQL injection patterns in the 'tag' parameter
Add WAF rule: Block requests with SQL keywords in 'tag' parameter
🧯 If You Can't Patch
- Disable com_tag component entirely if not needed
- Implement strict network segmentation and limit database permissions
🔍 How to Verify
Check if Vulnerable:
Check Joomla! Extension Manager for com_tag component version. If version is 1.7.6, system is vulnerable.Check Version:
Check Joomla! admin panel → Extensions → Manage → Search for 'com_tag'Verify Fix Applied:
Verify com_tag component version is 1.7.7 or later in Joomla! Extension Manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in Joomla! logs
- Multiple requests with SQL keywords in 'tag' parameter
- Unexpected database queries from web server
Network Indicators:
- GET requests with SQL injection patterns in URL parameters
- Unusual database connections from web server
SIEM Query:
source="joomla.logs" AND ("SQL syntax" OR "tag=" AND (SELECT OR UNION OR DROP OR INSERT))