CVE-2017-20271: Joomla StreetGuessr SQL Injection Flaw

CVE-2017-20271 Overview

CVE-2017-20271 is an SQL injection vulnerability [CWE-89] in the Joomla StreetGuessr Game extension version 1.1.8. The flaw resides in the catid parameter of the com_streetguess component. Unauthenticated attackers can inject arbitrary SQL statements by sending crafted GET requests to index.php with the option=com_streetguess&view=maps parameters. Successful exploitation allows retrieval of sensitive database information, including the database version and schema names.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents from vulnerable Joomla installations through a single HTTP GET request.

Affected Products

Joomla StreetGuessr Game extension version 1.1.8
Joomla installations with the com_streetguess component enabled
Web servers hosting the vulnerable extension with network-accessible index.php

Discovery Timeline

2026-06-19 - CVE-2017-20271 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2017-20271

Vulnerability Analysis

The StreetGuessr Game extension fails to sanitize the catid GET parameter before incorporating it into a SQL query. When a request to index.php?option=com_streetguess&view=maps&catid=<payload> is processed, the attacker-controlled value is concatenated directly into the database query. This permits classic union-based and boolean-based SQL injection techniques against the backend database.

The vulnerability is exploitable without authentication. The maps view is publicly accessible on any Joomla site running the affected extension. Attackers can enumerate the database server version, list schemas, and extract table data by crafting UNION SELECT payloads in the catid value.

Because Joomla extensions typically share the same database credentials as the core CMS, exploitation can expose user records, session tokens, and configuration data stored alongside the extension's tables.

Root Cause

The root cause is missing input validation and the absence of parameterized queries in the component's request handling logic. The catid parameter is treated as a trusted integer but is concatenated into SQL without type casting or prepared statement binding.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker issues an HTTP GET request to the vulnerable endpoint with a malicious catid payload. The vulnerable URL pattern is index.php?option=com_streetguess&view=maps&catid=[SQLi]. See the Exploit-DB entry #42423 and the VulnCheck Security Advisory for technical details.

Detection Methods for CVE-2017-20271

Indicators of Compromise

HTTP requests to index.php containing option=com_streetguess combined with view=maps and a catid parameter holding SQL keywords such as UNION, SELECT, SLEEP, CONCAT, or INFORMATION_SCHEMA.
Web server access logs showing unusually long catid values or URL-encoded SQL syntax (%20UNION%20, %27, --).
Database error messages or 500 responses correlated with com_streetguess requests, suggesting injection probing.

Detection Strategies

Inspect web server and Joomla logs for the com_streetguess component combined with anomalous catid parameter values.
Deploy a Web Application Firewall (WAF) ruleset that flags SQL syntax in query string parameters for Joomla endpoints.
Monitor database query logs for queries originating from the StreetGuessr component that reference INFORMATION_SCHEMA or system tables.

Monitoring Recommendations

Enable query logging on the database backend and alert on unexpected UNION or schema-enumeration queries.
Correlate HTTP 4xx/5xx spikes on index.php with source IP reputation feeds to identify scanning activity.
Track repeated requests from a single source to com_streetguess endpoints across short time windows.

How to Mitigate CVE-2017-20271

Immediate Actions Required

Disable or uninstall the StreetGuessr Game extension until a verified fix is applied.
Restrict access to index.php?option=com_streetguess via WAF rules or web server configuration.
Audit the Joomla database for signs of unauthorized data extraction, including unexpected reads of users and session tables.

Patch Information

No vendor patch is referenced in the available advisories. Administrators should remove the extension and contact the developer for an updated release. Consult the VulnCheck Security Advisory for the latest remediation status.

Workarounds

Block requests matching the pattern option=com_streetguess&view=maps at the WAF or reverse proxy layer.
Apply input validation rules that reject non-numeric catid values before they reach Joomla.
Enforce least-privilege database accounts so the Joomla user cannot read sensitive schemas outside its own database.

bash

# Example nginx rule to block exploitation attempts
if ($args ~* "option=com_streetguess.*catid=.*(union|select|sleep|information_schema)") {
    return 403;
}