CVE-2017-20274: Joomla LMS King SQL Injection Vulnerability

CVE-2017-20274 Overview

CVE-2017-20274 is a SQL injection vulnerability in Joomla LMS King Professional version 3.2.4.0. The flaw resides in the cp_id parameter of the learningpath task within the com_lmsking component. Unauthenticated attackers can send crafted GET requests to index.php to inject arbitrary SQL into backend database queries. Successful exploitation allows extraction of sensitive data from the underlying database, including credentials and learner records. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Remote, unauthenticated attackers can execute arbitrary SQL queries against the backend database, exposing confidential data stored by the Joomla LMS King Professional extension.

Affected Products

Joomla LMS King Professional 3.2.4.0
com_lmsking Joomla extension component
Joomla installations bundling the vulnerable LMS King Professional extension

Discovery Timeline

2026-06-19 - CVE-2017-20274 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2017-20274

Vulnerability Analysis

The vulnerability exists in the learningpath layout handler of the com_lmsking Joomla component. The cp_id parameter is concatenated directly into a SQL statement without parameterization or sanitization. Attackers reach the vulnerable code path through standard Joomla front-controller routing using option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath. No authentication, user interaction, or elevated privileges are required to trigger the flaw.

Root Cause

The component fails to validate or escape user-supplied input passed through the cp_id GET parameter. The value flows into a database query string built via raw concatenation rather than prepared statements. This omission of input neutralization is the canonical pattern described by CWE-89.

Attack Vector

Exploitation is performed over the network through standard HTTP GET requests. An attacker appends SQL payloads to the cp_id parameter on the vulnerable URL. The injected SQL executes within the database context used by Joomla, enabling UNION-based or boolean-based data extraction. Public proof-of-concept details are available in Exploit-DB #42415 and the VulnCheck Advisory on Joomla LMS SQL Injection.

No verified exploit code is reproduced here. Refer to the linked advisories for full technical detail.

Detection Methods for CVE-2017-20274

Indicators of Compromise

HTTP GET requests to index.php containing the parameter combination option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath.
Anomalous values in the cp_id query parameter containing SQL keywords such as UNION, SELECT, SLEEP, CONCAT, or comment markers (--, #, /*).
Database error messages referencing the com_lmsking tables appearing in Joomla or PHP error logs.

Detection Strategies

Inspect web server access logs for requests matching the vulnerable URL pattern and unusual cp_id payloads.
Deploy web application firewall (WAF) signatures targeting SQL injection patterns on Joomla com_lmsking endpoints.
Monitor database query logs for unexpected UNION SELECT activity originating from the Joomla service account.

Monitoring Recommendations

Alert on bursts of 4xx or 5xx responses from index.php requests tied to the LMS King component, which often indicate injection probing.
Track outbound data volume from the database host to detect bulk extraction following successful injection.
Correlate Joomla session activity with parameter tampering events to identify automated exploitation tooling.

How to Mitigate CVE-2017-20274

Immediate Actions Required

Disable or unpublish the com_lmsking component in the Joomla administrator interface until a fix is applied.
Block requests containing the vulnerable URL pattern at the WAF or reverse proxy layer.
Audit the database for unauthorized read activity against tables used by LMS King Professional.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2017-20274. Administrators should consult the vendor directly for an updated release of LMS King Professional or migrate to a maintained Joomla LMS alternative. Review the VulnCheck Advisory on Joomla LMS SQL Injection for the latest remediation status.

Workarounds

Remove the com_lmsking extension from production Joomla installations where a vendor fix is unavailable.
Enforce least-privilege permissions on the database account used by Joomla to limit the scope of data exposure.
Apply WAF rules that reject cp_id values containing SQL metacharacters or that enforce numeric-only input on this parameter.

bash

# Example ModSecurity rule blocking SQLi attempts against the vulnerable endpoint
SecRule REQUEST_URI "@contains option=com_lmsking" \
    "chain,phase:2,deny,status:403,id:1720274,msg:'CVE-2017-20274 LMS King SQLi attempt'"
    SecRule ARGS:cp_id "!@rx ^[0-9]+$" "t:none"