CVE-2017-20259: Joomla OSDownloads SQL Injection Flaw

CVE-2017-20259 Overview

CVE-2017-20259 is a SQL injection vulnerability in the Joomla OSDownloads extension version 1.7.4. The flaw resides in the item view, where the id parameter is passed directly into a SQL query without proper sanitization. Unauthenticated attackers can send crafted GET requests to index.php with parameters option=com_osdownloads&view=item&id=[SQL] to inject arbitrary SQL syntax. Successful exploitation allows extraction of database contents, including Joomla user credentials, session tokens, and configuration data. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote, unauthenticated attackers can exfiltrate sensitive database contents from Joomla sites running OSDownloads 1.7.4 by manipulating the id parameter in the item view.

Affected Products

Joomla OSDownloads extension version 1.7.4
Joomla CMS installations with the vulnerable com_osdownloads component enabled
Public-facing Joomla sites exposing the item view endpoint

Discovery Timeline

2026-06-19 - CVE-2017-20259 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2017-20259

Vulnerability Analysis

The OSDownloads extension processes the id query parameter when rendering the item view without applying parameterized queries or input validation. An attacker can append SQL syntax to the id value and have it concatenated directly into the underlying database query. This allows union-based, error-based, or boolean-based SQL injection techniques against the Joomla database. Because the endpoint is reachable without authentication, exploitation requires only the ability to send HTTP GET requests to the target site.

A proof-of-concept exploit is publicly available through Exploit-DB #42561, and technical analysis is documented in the VulnCheck Joomla SQL Injection Advisory. Confidentiality impact is high due to access to credentials stored in the #__users table, while integrity and availability impacts are limited to what the database user account permits.

Root Cause

The root cause is the absence of input sanitization and the use of dynamically constructed SQL statements in the item view handler. The id parameter is treated as a trusted integer but never cast or escaped before being inserted into the query. This violates the Joomla coding standard, which mandates use of the framework's parameter binding and query builder APIs.

Attack Vector

Exploitation occurs over the network through standard HTTP requests. An attacker issues a GET request such as index.php?option=com_osdownloads&view=item&id=1 and appends SQL syntax to the id value. Typical payloads use UNION SELECT clauses to retrieve columns from the Joomla users table, returning hashed passwords and email addresses in the rendered response.

No verified code examples are available for this advisory. Refer to the public Exploit-DB #42561 entry for the documented proof-of-concept payload.

Detection Methods for CVE-2017-20259

Indicators of Compromise

HTTP requests to index.php containing option=com_osdownloads&view=item&id= followed by SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA.
Web server access logs showing abnormally long id parameter values or URL-encoded SQL operators (%27, %20OR%20, %23).
Unexpected database errors in Joomla logs referencing the #__osdownloads_documents table or malformed SQL syntax.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL syntax in the id parameter of com_osdownloads requests.
Inspect Joomla application logs and PHP error logs for SQL exceptions originating from the OSDownloads component.
Correlate spikes in 500-series responses with com_osdownloads&view=item requests to identify exploitation attempts.

Monitoring Recommendations

Enable verbose query logging on the database server to capture suspicious SELECT statements referencing the #__users table from web sessions.
Alert on outbound data transfers from the web server that follow inbound requests to the vulnerable endpoint.
Maintain a baseline of normal request patterns for com_osdownloads and flag deviations in parameter length or character set.

How to Mitigate CVE-2017-20259

Immediate Actions Required

Upgrade the OSDownloads extension to the latest vendor-supplied version from Joomla Shack that addresses the SQL injection flaw.
Audit Joomla user accounts for unauthorized additions and force a password reset for all administrative users if exploitation is suspected.
Rotate the Joomla configuration.php secret and any database credentials that may have been exposed.

Patch Information

Update OSDownloads to a version newer than 1.7.4 via the Joomla extension manager or by downloading the patched release from the Joomla Extension Directory. Apply the patch immediately on any internet-facing Joomla installation that has the component enabled.

Workarounds

Disable or uninstall the com_osdownloads component until the patched version can be deployed.
Deploy a WAF rule that blocks requests where the id parameter on the com_osdownloads item view contains non-numeric characters.
Restrict access to the OSDownloads endpoint by IP allow-listing or HTTP authentication until remediation is complete.

bash

# Example ModSecurity rule to block SQL injection attempts against the vulnerable endpoint
SecRule REQUEST_URI "@contains option=com_osdownloads" \
    "chain,deny,status:403,id:1720259,msg:'CVE-2017-20259 OSDownloads SQLi attempt'"
  SecRule ARGS:id "!@rx ^[0-9]+$"