CVE-2017-17872
📋 TL;DR
This SQL injection vulnerability in JEXTN Video Gallery for Joomla allows attackers to execute arbitrary SQL commands through the id parameter. Attackers can potentially access, modify, or delete database content. All Joomla sites using the vulnerable extension version are affected.
💻 Affected Systems
- JEXTN Video Gallery extension for Joomla
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and full system takeover via subsequent attacks.
Likely Case
Database information disclosure, potential authentication bypass, and data manipulation.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Exploit requires no authentication and is publicly available with working proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.6 or later
Vendor Advisory: https://www.jextn.com/
Restart Required: No
Instructions:
1. Update JEXTN Video Gallery extension to version 3.0.6 or later. 2. Apply update through Joomla extension manager. 3. Clear Joomla cache after update.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize id parameter before processing
Modify component code to validate/sanitize id parameter using Joomla's JFilterInput
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule to detect and block SQL injection attempts on id parameter
🧯 If You Can't Patch
- Disable or remove JEXTN Video Gallery extension immediately
- Implement strict network segmentation and access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check Joomla extension manager for JEXTN Video Gallery version. If version is 3.0.5, system is vulnerable.Check Version:
Check via Joomla admin panel: Extensions → Manage → Check version of JEXTN Video GalleryVerify Fix Applied:
Confirm JEXTN Video Gallery version is 3.0.6 or later in Joomla extension manager.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests with SQL injection patterns in id parameter
- Error logs showing SQL syntax errors
Network Indicators:
- HTTP requests containing SQL keywords in id parameter
- Unusual traffic patterns to video gallery component
SIEM Query:
web.url:*view=category* AND web.param.id:*SELECT* OR web.param.id:*UNION* OR web.param.id:*OR*