CVE-2017-20263: Joomla FocalPoint SQLi Vulnerability

CVE-2017-20263 Overview

CVE-2017-20263 is an SQL injection vulnerability [CWE-89] in the Joomla! FocalPoint Pro/Free component version 1.2.3. The flaw resides in the com_focalpoint extension, where the id parameter passed to the location view is concatenated into a database query without sanitization. Unauthenticated attackers can send crafted GET requests to index.php and execute arbitrary SQL statements against the underlying database.

Critical Impact
Remote attackers can extract sensitive data from the Joomla! database, including administrator credentials and session tokens, without authentication.

Affected Products

Joomla! FocalPoint Pro 1.2.3
Joomla! FocalPoint Free 1.2.3
Joomla! installations using the com_focalpoint component with the location view

Discovery Timeline

2026-06-19 - CVE-2017-20263 published to the National Vulnerability Database (NVD)
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20263

Vulnerability Analysis

The FocalPoint component exposes a location view through Joomla!'s standard routing system. When a user requests a location page, the component reads the id query string parameter and incorporates it directly into an SQL statement used to fetch location records. The component fails to cast the value to an integer, escape it, or use parameterized queries.

Attackers reach the vulnerable code path with a request similar to index.php?option=com_focalpoint&view=location&id=<payload>. Because the id parameter is concatenated into the query, an attacker can append UNION SELECT statements, extract data from arbitrary tables, and enumerate the database schema. Exploitation requires no authentication and no user interaction.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The component trusts user-supplied input from the id request parameter and passes it to the Joomla! database driver as part of a raw query string instead of binding it as a typed parameter.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues a single GET request against the public Joomla! site, replacing the id parameter with a UNION-based or boolean-based SQL injection payload. Public exploitation details are documented in Exploit-DB #42530 and the VulnCheck Advisory for Joomla SQL Injection.

A representative malicious request takes the form GET /index.php?option=com_focalpoint&view=location&id=1 UNION SELECT username,password FROM jos_users--, which forces the backend to append attacker-controlled SQL onto the legitimate location lookup query.

Detection Methods for CVE-2017-20263

Indicators of Compromise

HTTP GET requests to index.php containing option=com_focalpoint and view=location with non-numeric id values.
Request logs showing SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or -- inside the id parameter.
Spikes in database query errors or unusually long response times tied to the FocalPoint endpoint.
Outbound queries from the web server to the jos_users or equivalent credentials table outside normal admin workflows.

Detection Strategies

Inspect web server access logs and WAF telemetry for the URI pattern option=com_focalpoint&view=location&id= followed by SQL metacharacters.
Enable Joomla! database error logging and alert on syntax errors generated by the FocalPoint component.
Apply WAF signatures for generic SQL injection patterns and scope them to the com_focalpoint route.

Monitoring Recommendations

Forward Apache, Nginx, and Joomla! application logs to a centralized SIEM for correlation against known SQLi patterns.
Monitor for unauthenticated requests that return abnormally large response bodies from the location view.
Track database read volume from the Joomla! service account and alert on access to authentication tables outside of admin sessions.

How to Mitigate CVE-2017-20263

Immediate Actions Required

Disable or uninstall the FocalPoint Pro/Free 1.2.3 component from any production Joomla! site until a vendor-supplied fix is verified.
Block requests matching option=com_focalpoint&view=location at the WAF or reverse proxy if the component cannot be removed immediately.
Rotate Joomla! administrator passwords and any database credentials that may have been exposed.
Review database audit logs for unauthorized SELECT activity against jos_users and session tables.

Patch Information

No vendor advisory or patched version is referenced in the NVD entry. Administrators should consult the Focal Point X Homepage for vendor updates and remove the affected version until a fixed release is confirmed. Public exploit details are available in Exploit-DB #42530 and the VulnCheck Advisory for Joomla SQL Injection.

Workarounds

Place the Joomla! site behind a WAF with rules that reject non-numeric values in the id query parameter for the FocalPoint route.
Restrict access to the FocalPoint location view to authenticated sessions via Joomla! ACL or web server-level authentication.
Apply least-privilege permissions to the database user backing Joomla! so the account cannot read tables unrelated to the FocalPoint component.

bash

# Example Nginx rule to block SQL metacharacters in the FocalPoint id parameter
location = /index.php {
    if ($args ~* "option=com_focalpoint.*view=location.*id=[^0-9]") {
        return 403;
    }
}