CVE-2017-20275: Joomla! PHP-Bridge SQLi Vulnerability

CVE-2017-20275 Overview

CVE-2017-20275 is an SQL injection vulnerability [CWE-89] in the Joomla! PHP-Bridge component version 1.2.3. The flaw exists in the handling of the id parameter when requests are sent to index.php with option=com_phpbridge&view=phpview. Unauthenticated attackers can inject arbitrary SQL queries through this parameter to extract database content, including table and column metadata.

The vulnerability is exploitable remotely over the network without user interaction or authentication. An exploit module was published in Exploit-DB entry 42414, lowering the barrier to exploitation.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents from Joomla! installations running the vulnerable PHP-Bridge component.

Affected Products

Joomla! PHP-Bridge Component version 1.2.3
Joomla! installations with PHP-Bridge extension enabled
Web applications exposing the com_phpbridge endpoint

Discovery Timeline

2026-06-19 - CVE-2017-20275 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20275

Vulnerability Analysis

The PHP-Bridge component does not sanitize the id parameter before incorporating it into SQL statements. When a request reaches index.php?option=com_phpbridge&view=phpview&id=<payload>, the user-supplied value is concatenated directly into a database query. Attackers can append UNION SELECT statements or boolean-based payloads to retrieve arbitrary data from the underlying database.

Because the endpoint is reachable without authentication, exploitation requires only HTTP access to the Joomla! site. The vulnerability class is classic in-band SQL injection, allowing attackers to enumerate schemas, dump credentials, and exfiltrate stored user data. The EPSS score of 0.232% reflects current exploitation probability, though the public availability of an Exploit-DB module increases practical risk.

Root Cause

The root cause is missing input validation and lack of parameterized queries in the PHP-Bridge component's view handler. The id value is treated as trusted input and inserted into the SQL string without escaping or type casting. This is a textbook violation of secure coding practices for database access in PHP-based Joomla! extensions.

Attack Vector

An attacker sends a crafted GET request to the vulnerable endpoint:

GET /index.php?option=com_phpbridge&view=phpview&id=<SQLi payload>

The payload can use UNION-based injection to read from information_schema tables and enumerate database structure. Once the schema is mapped, attackers extract sensitive tables such as #__users to harvest credentials. No authentication, session token, or user interaction is required to deliver the payload.

Technical details and a working proof of concept are documented in Exploit-DB entry 42414 and the VulnCheck advisory.

Detection Methods for CVE-2017-20275

Indicators of Compromise

HTTP requests to index.php containing option=com_phpbridge and view=phpview with SQL keywords such as UNION, SELECT, INFORMATION_SCHEMA, or -- in the id parameter.
Web server access logs showing unusually long id values or URL-encoded SQL syntax targeting the PHP-Bridge endpoint.
Database error messages or anomalous query response sizes correlated with PHP-Bridge requests.

Detection Strategies

Deploy web application firewall (WAF) rules to flag SQL metacharacters in the id parameter of com_phpbridge requests.
Enable database query logging and alert on UNION SELECT patterns originating from the Joomla! application user.
Correlate web request logs with database audit trails to identify successful injection attempts that return non-standard column counts.

Monitoring Recommendations

Monitor outbound traffic from the Joomla! server for unexpected data exfiltration following requests to the PHP-Bridge endpoint.
Track repeated 400/500 responses on com_phpbridge URLs, which often accompany injection probing.
Review authentication logs for credential reuse from accounts stored in the Joomla! #__users table.

How to Mitigate CVE-2017-20275

Immediate Actions Required

Disable or uninstall the PHP-Bridge component (com_phpbridge) if it is not required.
Block public access to the /index.php?option=com_phpbridge URL pattern at the WAF or reverse proxy until a remediated version is available.
Audit the Joomla! database for unauthorized read activity and rotate credentials stored in #__users.

Patch Information

No official vendor patch is referenced in the available advisories for PHP-Bridge 1.2.3. Administrators should consult the VulnCheck advisory for the latest remediation guidance and confirm directly with the extension maintainer before reinstalling the component.

Workarounds

Remove the PHP-Bridge extension from the Joomla! Extensions Manager to eliminate the attack surface.
Apply WAF signatures that reject SQL keywords and metacharacters on the id parameter for all Joomla! component requests.
Enforce least-privilege on the Joomla! database account so it cannot read sensitive system tables or write to authentication tables.

bash

# Example WAF rule (ModSecurity) to block SQLi on com_phpbridge
SecRule REQUEST_URI "@contains option=com_phpbridge" \
    "chain,deny,status:403,id:1020275,msg:'CVE-2017-20275 PHP-Bridge SQLi attempt'"
    SecRule ARGS:id "@rx (?i)(union\s+select|information_schema|--|/\*)" "t:none,t:urlDecode"