CVE-2017-20272: Joomla Ultimate Property Listing SQLi

CVE-2017-20272 Overview

CVE-2017-20272 is an SQL injection vulnerability in Joomla Ultimate Property Listing 1.0.2. The flaw resides in the sf_selectuser_id parameter exposed by the com_upl component. Unauthenticated attackers can inject arbitrary SQL through crafted GET requests to index.php using the option=com_upl and view=propertylisting parameters. Successful exploitation allows attackers to enumerate database schema, extract table names and column structures, and read sensitive records. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract arbitrary data from the backend database by injecting SQL through the sf_selectuser_id parameter.

Affected Products

Joomla Ultimate Property Listing extension version 1.0.2
Joomla CMS installations with the com_upl component enabled
Web applications exposing the propertylisting view of the extension

Discovery Timeline

2026-06-19 - CVE-2017-20272 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20272

Vulnerability Analysis

The vulnerability exists in the Ultimate Property Listing component for Joomla. The sf_selectuser_id GET parameter is concatenated into a backend SQL query without parameterization or sanitization. Attackers send requests to index.php?option=com_upl&view=propertylisting&sf_selectuser_id=<payload> and append SQL syntax such as UNION SELECT statements to read data outside the original query context. Because the request requires no authentication, the attack can be launched directly over the network against any vulnerable installation.

Root Cause

The root cause is improper neutralization of user-supplied input in an SQL statement [CWE-89]. The component trusts the sf_selectuser_id value passed through the HTTP request and inserts it directly into a database query. Standard defenses such as prepared statements, the Joomla JDatabaseQuery parameter binding API, or input casting to integer were not applied to this parameter.

Attack Vector

Exploitation occurs over the network with no privileges and no user interaction. An attacker crafts a GET request to the public-facing Joomla site with the vulnerable parameter set to a SQL injection payload. Boolean-based, UNION-based, or time-based techniques can be used to enumerate information_schema tables, recover credentials, and exfiltrate stored property records. A public proof of concept is referenced in Exploit-DB #42417 and the VulnCheck advisory.

No verified exploit code is reproduced here. Refer to the linked advisories for technical payload details.

Detection Methods for CVE-2017-20272

Indicators of Compromise

HTTP GET requests to index.php containing option=com_upl, view=propertylisting, and sf_selectuser_id parameters with SQL metacharacters such as ', UNION, SELECT, --, or /*.
Database error messages or unusually large response bodies returned from requests targeting the sf_selectuser_id parameter.
Web server access logs showing repeated requests iterating over numeric or hex-encoded payloads against the com_upl endpoint.

Detection Strategies

Deploy web application firewall rules that inspect query strings for SQL injection signatures targeting the sf_selectuser_id parameter.
Enable verbose query logging on the backend database and alert on information_schema access originating from the Joomla application user.
Correlate web access logs with database query patterns to identify reconnaissance activity probing the com_upl component.

Monitoring Recommendations

Monitor outbound responses for sensitive table or column names appearing in HTTP responses from the property listing endpoint.
Track anomalous response sizes and HTTP 500 errors on requests to index.php?option=com_upl.
Audit installed Joomla extensions on a recurring basis to identify abandoned or unpatched components such as Ultimate Property Listing.

How to Mitigate CVE-2017-20272

Immediate Actions Required

Disable or uninstall the Ultimate Property Listing (com_upl) component until a fix is verified.
Block requests to index.php?option=com_upl&view=propertylisting containing SQL metacharacters at the WAF or reverse proxy layer.
Review database logs for prior exploitation and rotate any credentials stored in tables accessible by the Joomla database user.

Patch Information

No vendor patch is referenced in the available advisories for Joomla Ultimate Property Listing 1.0.2. Administrators should consult the VulnCheck advisory for current remediation guidance and confirm whether a newer extension version is available from the developer before reinstallation.

Workarounds

Remove the com_upl component from the Joomla extension manager to eliminate the vulnerable code path.
Apply WAF signatures that reject any value for sf_selectuser_id that is not strictly numeric.
Restrict the Joomla database account to the minimum required privileges and revoke access to information_schema where feasible.
Place the affected site behind authentication or an IP allowlist while remediation is in progress.

bash

# Example ModSecurity rule to block non-numeric sf_selectuser_id values
SecRule ARGS:sf_selectuser_id "!@rx ^[0-9]+$" \
    "id:1020272,phase:2,deny,status:403,log,\
     msg:'CVE-2017-20272 Joomla com_upl SQLi attempt'"