CVE-2017-20253: Joomla! My Projects SQL Injection Flaw

CVE-2017-20253 Overview

CVE-2017-20253 is a SQL injection vulnerability in the Joomla! My Projects component version 2.0. The flaw resides in the handling of the VerAyari parameter, which the component passes to backend database queries without proper sanitization. Unauthenticated remote attackers can inject crafted SQL payloads through this parameter to manipulate database queries. Successful exploitation enables extraction of sensitive data, including user credentials, session information, and configuration details stored in the Joomla! database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the backend database, exposing credentials and system data from Joomla! sites running the vulnerable My Projects component.

Affected Products

Joomla! Component My Projects 2.0
Joomla! installations with the My Projects portfolio extension enabled
Web applications integrating the vulnerable component endpoint

Discovery Timeline

2026-06-19 - CVE-2017-20253 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2017-20253

Vulnerability Analysis

The My Projects 2.0 component is a portfolio extension for Joomla! used to display projects on public-facing pages. The component accepts user-supplied input through the VerAyari GET parameter and concatenates this value directly into a SQL query string. Because the component does not parameterize the query or apply input validation, an attacker can append SQL syntax through the parameter to alter query logic.

Attackers can craft requests that introduce UNION-based or boolean-based injection payloads, allowing them to read arbitrary tables from the underlying database. The Joomla! #__users table contains administrator password hashes, session tokens, and email addresses, all of which become accessible through the injection.

Exploitation requires no authentication and no user interaction. The attack is delivered over a standard HTTP request, making it suitable for automated mass scanning and exploitation tools.

Root Cause

The root cause is improper neutralization of special elements in a SQL command [CWE-89]. The component constructs SQL statements through string concatenation using the unvalidated VerAyari request parameter, rather than using prepared statements or Joomla!'s built-in database abstraction layer with parameter binding.

Attack Vector

The attack vector is network-based. Attackers send HTTP GET requests to the component endpoint with a SQL injection payload appended to the VerAyari parameter. A working proof-of-concept is published in Exploit-DB #43358, and additional context is available in the VulnCheck Advisory on Joomla SQL Injection.

The vulnerability manifests when the component processes the VerAyari parameter. Refer to the published advisories for the verified payload structure and response indicators rather than fabricated examples.

Detection Methods for CVE-2017-20253

Indicators of Compromise

HTTP requests targeting the My Projects component endpoint containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the VerAyari parameter
Web server access logs showing repeated requests to the component with encoded characters such as %27, %20, or %2D%2D in the VerAyari value
Unusual database query patterns or errors referencing the #__users or #__session tables originating from the Joomla! web user
Outbound data transfer spikes following requests to the vulnerable endpoint

Detection Strategies

Deploy a web application firewall (WAF) rule set that matches SQL injection signatures on the VerAyari parameter and similar component inputs
Inspect Joomla! and database server logs for malformed SQL or syntax errors tied to the My Projects component path
Correlate web request anomalies with authentication events to identify credential extraction attempts

Monitoring Recommendations

Enable verbose query logging on the MySQL or MariaDB instance backing the Joomla! site and alert on queries containing UNION SELECT originating from the web application user
Monitor for high request rates against the My Projects component URL from a single source IP
Track changes to administrator accounts and privileged users in the #__users table as a downstream signal of successful exploitation

How to Mitigate CVE-2017-20253

Immediate Actions Required

Disable or uninstall the My Projects 2.0 component from any affected Joomla! installation until a verified patched version is available
Audit web server and database logs for prior exploitation attempts referencing the VerAyari parameter
Rotate all Joomla! administrator and user credentials if exploitation indicators are present, and invalidate active sessions

Patch Information

No vendor patch is referenced in the available advisories. Confirm the status of the extension with the maintainer through the Joomla Extension Documentation before reinstating the component. If a fixed release is unavailable, remove the component permanently and select a maintained alternative.

Workarounds

Block requests to the My Projects component URL at the web server or reverse proxy layer using rewrite rules or location-based denies
Deploy WAF signatures that reject requests containing SQL metacharacters in the VerAyari parameter
Restrict outbound database privileges of the Joomla! web application account so it cannot read sensitive tables it does not require
Apply least-privilege database roles and enforce network segmentation between the Joomla! front end and the database tier

bash

# Example Apache configuration to block requests to the vulnerable component
<LocationMatch "/index\.php\?option=com_myprojects">
    SetEnvIfNoCase QUERY_STRING "VerAyari=.*(union|select|sleep|--|%27)" block_sqli
    Require all granted
    Require not env block_sqli
</LocationMatch>