CVE-2017-20260: Joomla Price Alert SQL Injection Flaw

CVE-2017-20260 Overview

CVE-2017-20260 is an SQL injection vulnerability [CWE-89] in the Joomla! Price Alert component version 3.0.2. The flaw exists in the subscribeajax view, which fails to sanitize the product_id parameter before passing it into a database query. Unauthenticated remote attackers can submit crafted requests containing malicious SQL payloads to extract data from the underlying database. Exposed data includes administrative credentials, configuration values, and customer records stored by the Joomla! and VirtueMart installation.

Critical Impact
Unauthenticated attackers can extract credentials and sensitive database content from any Joomla! site running Price Alert 3.0.2 by sending a single crafted HTTP request.

Affected Products

Joomla! Price Alert component version 3.0.2
Joomla! installations using VirtueMart with the Price Alert extension
The vulnerable subscribeajax view handler

Discovery Timeline

2026-06-19 - CVE-2017-20260 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20260

Vulnerability Analysis

The vulnerability resides in the request handler for the subscribeajax view of the Price Alert component. The handler reads the product_id HTTP parameter and concatenates the value into a SQL statement without parameterization or input validation. Because the endpoint is reachable without authentication, any remote user can trigger the injection. Successful exploitation enables UNION-based or error-based extraction of arbitrary database tables, including the Joomla! #__users table that stores hashed administrator credentials. An attacker who recovers and cracks an administrator hash can pivot to full site compromise, including arbitrary file upload through the Joomla! template manager.

Root Cause

The component performs string concatenation when building the query for product_id. No prepared statements, type casting, or input filtering are applied. This is a textbook CWE-89 SQL injection pattern.

Attack Vector

Exploitation requires only network access to the Joomla! site. The attacker sends an HTTP request to the Joomla! index endpoint with option=com_pricealert, view=subscribeajax, and a product_id value containing a SQL payload. The injected payload is appended to the original query, allowing data exfiltration through UNION clauses or boolean-based blind techniques. Public exploitation details are documented in Exploit-DB #42553 and the VulnCheck Joomla Advisory.

No verified code examples are available. Refer to the published advisory for payload structure.

Detection Methods for CVE-2017-20260

Indicators of Compromise

HTTP requests to index.php containing option=com_pricealert and view=subscribeajax with non-numeric product_id values.
Web server log entries showing SQL keywords such as UNION, SELECT, SLEEP, or CONCAT inside the product_id parameter.
Unexpected reads from the #__users, #__session, or #__extensions tables originating from the web application user.
Outbound connections from the web server immediately after suspicious subscribeajax requests, suggesting credential exfiltration.

Detection Strategies

Inspect web access logs for requests targeting com_pricealert with URL-encoded SQL metacharacters in product_id.
Enable MySQL or MariaDB general query logging temporarily and alert on queries referencing pricealert joined with sensitive tables.
Deploy a web application firewall ruleset for generic SQL injection signatures, focusing on Joomla! component endpoints.

Monitoring Recommendations

Monitor the Joomla! administrator account list for unexpected new users or privilege changes.
Alert on changes to the #__users table or to the secret value in configuration.php.
Track failed administrator logins followed by a successful login from a new IP address.

How to Mitigate CVE-2017-20260

Immediate Actions Required

Disable or uninstall the Price Alert component until a fixed version is confirmed by the maintainer.
Rotate all Joomla! administrator passwords and the database account password used by the site.
Review the #__users table and remove any unauthorized accounts created during the exposure window.
Audit the templates/ and media/ directories for unexpected PHP files that may indicate post-exploitation webshells.

Patch Information

No vendor patch is referenced in the NVD entry for Price Alert 3.0.2. Confirm the current status with the maintainer through the Joomla Price Alert Extension listing. Upgrade to a newer release if one is available, or migrate to an actively maintained alternative.

Workarounds

Block requests to index.php?option=com_pricealert&view=subscribeajax at the reverse proxy or web application firewall.
Enforce strict numeric validation on product_id using a WAF rule that rejects any non-digit characters.
Restrict the database user used by Joomla! to the minimum required privileges, denying access to unrelated schemas.

bash

# Example ModSecurity rule to block non-numeric product_id values
SecRule ARGS:product_id "!@rx ^[0-9]+$" \
    "id:1720260,phase:2,deny,status:403,\
    msg:'CVE-2017-20260 Joomla Price Alert SQLi attempt',\
    tag:'attack-sqli'"