CVE-2017-20255: Joomla JB Visa SQLi Vulnerability

CVE-2017-20255 Overview

CVE-2017-20255 is an SQL injection vulnerability [CWE-89] in the Joomla! JB Visa component version 1.0, developed by Joombooking. The flaw resides in the visatype parameter exposed through index.php when invoked with option=com_bookpro and view=popup. Unauthenticated attackers can craft GET requests that inject arbitrary SQL into backend database queries. Successful exploitation allows extraction of sensitive data, including administrative credentials and full table contents.

Critical Impact
Unauthenticated remote attackers can exfiltrate database contents, including Joomla! administrator credentials, through a single crafted HTTP GET request.

Affected Products

Joomla! Component JB Visa 1.0
Joombooking JB Visa extension for Joomla!
Joomla! sites using the com_bookpro extension with the JB Visa module enabled

Discovery Timeline

2026-06-19 - CVE-2017-20255 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20255

Vulnerability Analysis

The JB Visa component fails to sanitize or parameterize the visatype GET parameter before concatenating it into an SQL statement. The vulnerable endpoint is reachable without authentication at index.php?option=com_bookpro&view=popup. An attacker supplies SQL syntax in visatype, which the component passes directly to the database driver.

Because the injection occurs in a SELECT-style query path, attackers can use UNION SELECT statements to enumerate schema, dump tables, and extract column values. The Joomla! #__users table is a primary target, exposing hashed admin credentials. The flaw maps to [CWE-89] — Improper Neutralization of Special Elements used in an SQL Command.

EPSS data places exploitation probability at 0.334% with a percentile of 25.18, but a public proof-of-concept is published as Exploit-DB #43350, lowering the practical barrier to attack.

Root Cause

The root cause is missing input validation and absence of prepared statements in the SQL query that consumes the visatype parameter. User-controlled input flows into a dynamically built query string without escaping or type enforcement. Joomla!'s database abstraction layer supports parameter binding, but the JB Visa component bypasses it for this query path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker issues a single GET request to the vulnerable endpoint with a SQL payload appended to the visatype parameter. Tools such as sqlmap automate detection and exploitation against this parameter.

The vulnerability mechanism follows the pattern documented in the VulnCheck Advisory for Joomla and the published Exploit-DB #43350 proof-of-concept. No verified vendor patch code is publicly available for inclusion here.

Detection Methods for CVE-2017-20255

Indicators of Compromise

HTTP GET requests to index.php containing option=com_bookpro, view=popup, and a visatype parameter with SQL keywords such as UNION, SELECT, SLEEP, or --.
Web server access logs showing unusually long visatype values or URL-encoded SQL syntax (%27, %20UNION%20, %23).
Database error messages referencing #__users or other Joomla! tables in application logs.
Outbound queries from the Joomla! database user account that read from information_schema tables.

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects visatype parameter values for SQL metacharacters and known injection signatures.
Enable database query logging on the Joomla! MySQL instance and alert on UNION SELECT patterns targeting #__users.
Correlate web access logs with database query logs to identify single requests that trigger multi-table reads.

Monitoring Recommendations

Monitor for repeated 200 or 500 responses tied to com_bookpro requests originating from a single IP.
Track authentication anomalies on Joomla! administrator accounts following any suspicious visatype requests.
Alert on egress data volumes from web servers hosting vulnerable Joomla! sites.

How to Mitigate CVE-2017-20255

Immediate Actions Required

Disable or uninstall the JB Visa 1.0 component from Joomla! installations until a vendor fix is verified.
Block public access to index.php?option=com_bookpro&view=popup at the WAF or reverse proxy layer.
Rotate all Joomla! administrator passwords and any database credentials that may have been exposed.
Audit the #__users table and recent admin login activity for signs of compromise.

Patch Information

No confirmed vendor patch is referenced in the available advisory data. Consult the vendor at Joombooking Homepage and the Joomla Extension Listing for the latest component release and remove version 1.0 from production environments.

Workarounds

Apply WAF signatures that reject SQL keywords in the visatype query parameter for the com_bookpro endpoint.
Restrict the com_bookpro component to authenticated users via Joomla! access control lists if business requirements allow.
Run the Joomla! database user with least-privilege grants, removing access to tables outside the component's scope.
Replace the affected booking component with a maintained alternative listed in the official Joomla! extensions directory.

bash

# Example ModSecurity rule to block SQL injection in visatype parameter
SecRule ARGS:visatype "@rx (?i)(union(\s|\+)+select|sleep\(|information_schema|--|\b(or|and)\b\s+\d+=\d+)" \
    "id:1020255,phase:2,deny,status:403,log,msg:'CVE-2017-20255 JB Visa SQLi attempt'"