CVE-2017-20273: Joomla Event Registration Pro SQLi Flaw

CVE-2017-20273 Overview

CVE-2017-20273 is an SQL injection vulnerability in the Joomla Event Registration Pro Calendar extension version 4.1.3. The flaw resides in the id parameter of the com_registrationpro component, which fails to sanitize user input before passing it to database queries. Unauthenticated attackers can send crafted GET requests to index.php using option=com_registrationpro&view=category&id= with malicious payloads to extract sensitive database contents. The issue is classified under [CWE-89] for improper neutralization of special elements in SQL commands.

Critical Impact
Remote, unauthenticated attackers can extract arbitrary data from the backend database, including credentials and personally identifiable information stored by the Joomla site.

Affected Products

Joomla Event Registration Pro Calendar extension
Affected version: 4.1.3
Deployments running the com_registrationpro component on Joomla

Discovery Timeline

2026-06-19 - CVE-2017-20273 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20273

Vulnerability Analysis

The vulnerability stems from missing input validation on the id parameter accepted by the com_registrationpro extension. When a request reaches the category view, the id value is concatenated into a SQL statement without parameterization or type casting. An attacker supplies SQL syntax in place of an integer identifier, causing the database engine to execute the injected clauses. Because the request is processed without authentication, exposure does not require account access or user interaction.

The injected payload can append UNION-based queries, conditional subqueries, or time-based blind probes. Successful exploitation discloses contents of arbitrary tables in the Joomla database, including the #__users table which stores hashed credentials and email addresses. Public proof-of-concept exploitation is documented in Exploit-DB #42416 and the VulnCheck Joomla SQL Injection Advisory.

Root Cause

The extension passes the id GET parameter directly into a SQL query string without using prepared statements or Joomla's parameter binding APIs. The application also fails to enforce integer typing on the parameter, leaving the query open to operator and keyword injection.

Attack Vector

Attackers exploit the issue over the network by issuing a single HTTP GET request. The request targets index.php?option=com_registrationpro&view=category&id= followed by a SQL injection payload. No credentials, sessions, or user interaction are required, and the response body or response timing returns the extracted data to the attacker.

// Example exploitation pattern (sanitized)
GET /index.php?option=com_registrationpro&view=category&id=<SQLi_PAYLOAD> HTTP/1.1
Host: target.example

Detection Methods for CVE-2017-20273

Indicators of Compromise

HTTP access log entries containing option=com_registrationpro&view=category&id= with SQL keywords such as UNION, SELECT, SLEEP, CONCAT, or INFORMATION_SCHEMA.
Anomalous GET requests against index.php with unusually long id values or URL-encoded quote characters (%27, %22).
Database error messages referencing the #__events or #__users tables surfaced in web server responses.

Detection Strategies

Inspect web server and reverse proxy logs for requests targeting the com_registrationpro component with non-integer id values.
Deploy web application firewall signatures that flag SQL injection metacharacters and UNION-based payloads against Joomla endpoints.
Correlate failed login spikes or unauthorized administrative activity with prior suspicious requests to the vulnerable endpoint.

Monitoring Recommendations

Monitor database query logs for unexpected UNION SELECT statements originating from the Joomla application user.
Alert on outbound HTTP responses containing password hash patterns or large encoded data blobs from com_registrationpro URLs.
Track repeat access from single source IPs probing different id values against the extension within short time windows.

How to Mitigate CVE-2017-20273

Immediate Actions Required

Disable or uninstall the Event Registration Pro Calendar extension on any Joomla site running version 4.1.3 until a fixed release is deployed.
Block requests containing SQL metacharacters in the id parameter at the web application firewall or reverse proxy layer.
Rotate Joomla administrator credentials and reset user passwords if exploitation indicators are present in logs.

Patch Information

No vendor patch URL is published in the available CVE data. Administrators should consult the VulnCheck Joomla SQL Injection Advisory and the extension vendor for the latest fixed release, then upgrade beyond version 4.1.3.

Workarounds

Restrict access to index.php?option=com_registrationpro to authenticated administrators via web server access controls until patched.
Enforce strict input validation on the id parameter using WAF rules that accept only numeric values.
Remove the vulnerable component directory from the Joomla installation if the extension is not actively used.

bash

# Example WAF rule to drop non-numeric id parameters for com_registrationpro
SecRule ARGS:option "@streq com_registrationpro" \
    "chain,deny,status:403,id:1720273,msg:'CVE-2017-20273 SQLi attempt'"
    SecRule ARGS:id "!@rx ^[0-9]+$"