CVE-2018-17377
📋 TL;DR
This CVE describes a SQL injection vulnerability in the Questions 1.4.3 component for Joomla! CMS. Attackers can exploit parameters like term, userid, users, or groups to execute arbitrary SQL commands on the database. All Joomla! installations using the vulnerable Questions component version are affected.
💻 Affected Systems
- Joomla! CMS with Questions component
📦 What is this software?
Questions by Extensiondeveloper
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential privilege escalation to administrative access; possible remote code execution if database configuration permits.
Likely Case
Unauthorized access to sensitive data stored in the database (user credentials, personal information, content); potential website defacement or data manipulation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database user privilege restrictions in place.
🎯 Exploit Status
Multiple public exploit scripts available. Exploitation requires no authentication and uses simple SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Questions component version after 1.4.3
Vendor Advisory: https://extensions.joomla.org/extension/questions/
Restart Required: No
Instructions:
1. Update Questions component to latest version via Joomla! Extension Manager. 2. If update not available, uninstall Questions component completely. 3. Verify no vulnerable files remain in /components/com_questions/ directory.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation for term, userid, users, and groups parameters to reject SQL injection attempts
Modify component PHP files to add parameter validation before database queries
Web Application Firewall Rule
allBlock SQL injection patterns targeting Questions component parameters
Add WAF rule: Block requests containing SQL keywords in term, userid, users, or groups parameters
🧯 If You Can't Patch
- Disable or uninstall Questions component immediately
- Implement network segmentation to restrict database access from web server
🔍 How to Verify
Check if Vulnerable:
Check Joomla! administrator panel → Extensions → Manage → Check version of Questions component. If version is 1.4.3, system is vulnerable.Check Version:
Check Joomla! administrator panel or examine /administrator/components/com_questions/ directory for version filesVerify Fix Applied:
After update, verify Questions component version is greater than 1.4.3. Test parameter inputs with SQL injection payloads to confirm they're blocked.📡 Detection & Monitoring
Log Indicators:
- SQL error messages in Joomla! logs
- Unusual database queries from web server IP
- Multiple failed parameter requests to Questions component
Network Indicators:
- HTTP requests with SQL keywords in term/userid/users/groups parameters
- Unusual database port traffic from web server
SIEM Query:
source="joomla_logs" AND (message="*SQL*error*" OR message="*Questions*component*")