CVE-2017-20276: Joomla SIMGenealogy SQLi Vulnerability

CVE-2017-20276 Overview

CVE-2017-20276 is a SQL injection vulnerability [CWE-89] in the Joomla! SIMGenealogy component version 2.1.5. The flaw exists in the handling of the type parameter when requests are sent to index.php with option=com_simgenealogy and view=latest. Unauthenticated remote attackers can inject arbitrary SQL into the parameter to manipulate backend database queries. Successful exploitation allows extraction of sensitive data from the Joomla! database, including user records, credentials hashes, and session data.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the Joomla! backend database through a single GET request, exposing the contents of any accessible table.

Affected Products

Joomla! SIMGenealogy component version 2.1.5
Joomla! installations with com_simgenealogy enabled
Web applications exposing the vulnerable view=latest endpoint

Discovery Timeline

2026-06-19 - CVE-2017-20276 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20276

Vulnerability Analysis

The vulnerability resides in the com_simgenealogy Joomla! component, specifically in the request handler servicing the view=latest action. The component reads the type query parameter directly from user input and concatenates the value into a SQL statement without parameterization or escaping. An attacker submits a crafted GET request to index.php?option=com_simgenealogy&view=latest&type=<payload> to inject SQL syntax into the resulting query.

Because the endpoint requires no authentication, any internet-facing Joomla! site running SIMGenealogy 2.1.5 is reachable by remote attackers. UNION-based and error-based injection techniques both apply, enabling attackers to enumerate database schemas and exfiltrate row data. The vulnerability falls under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Root Cause

The root cause is the absence of input sanitization and parameterized queries in the SIMGenealogy component. User-supplied values from the type HTTP GET parameter flow directly into a SQL query string. The component does not apply Joomla!'s built-in JDatabaseQuery parameter binding, escape functions such as quote(), or input type enforcement before constructing the statement.

Attack Vector

Exploitation occurs over the network with no privileges or user interaction required. An attacker issues a single HTTP GET request targeting the vulnerable endpoint:

/index.php?option=com_simgenealogy&view=latest&type=[SQLi payload]

The injected payload modifies the query executed against the MySQL backend. Public exploitation details are documented in Exploit-DB entry 42413 and the VulnCheck Advisory for Joomla. No verified exploit code is reproduced here; refer to the linked advisories for technical proof-of-concept details.

Detection Methods for CVE-2017-20276

Indicators of Compromise

HTTP GET requests to index.php containing both option=com_simgenealogy and view=latest with suspicious type parameter values
Presence of SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or comment sequences (--, /*) within the type parameter
Anomalous database query latency or error log entries referencing the SIMGenealogy component
Unexpected outbound data transfers from the web server following SIMGenealogy requests

Detection Strategies

Inspect web server access logs for requests matching the com_simgenealogy and view=latest pattern with encoded SQL metacharacters in type
Deploy web application firewall (WAF) rules that block SQL injection patterns targeting Joomla! component query strings
Monitor MySQL slow query and error logs for malformed statements originating from the Joomla! application user

Monitoring Recommendations

Forward Joomla!, Apache or Nginx, and MySQL logs to a centralized logging platform for correlated analysis
Alert on repeated 500-series HTTP responses from index.php requests targeting com_simgenealogy
Track baseline request volumes to the SIMGenealogy endpoint and flag deviations indicative of automated scanning

How to Mitigate CVE-2017-20276

Immediate Actions Required

Disable or uninstall the SIMGenealogy 2.1.5 component from any Joomla! installation until a patched version is verified
Block requests to index.php?option=com_simgenealogy&view=latest at the WAF or reverse proxy layer
Audit the Joomla! database for unauthorized read activity, including dumps of the #__users table
Rotate credentials for any administrative accounts stored in the affected database

Patch Information

No vendor patch is referenced in the available advisories. Administrators should consult the VulnCheck Advisory for Joomla for updated remediation guidance and verify whether a maintained version of the SIMGenealogy extension is available. If no patched release exists, removal of the component is the recommended action.

Workarounds

Deploy WAF signatures that reject SQL metacharacters in the type query parameter for com_simgenealogy requests
Restrict access to the SIMGenealogy endpoints via IP allow-listing or HTTP authentication at the web server tier
Enforce least-privilege on the Joomla! database account so it cannot read sensitive tables outside the application schema
Enable Joomla!'s System - Filter plugin and configure strict input filtering for front-end components

bash

# Nginx configuration example: block vulnerable SIMGenealogy endpoint
location = /index.php {
    if ($args ~* "option=com_simgenealogy.*view=latest") {
        return 403;
    }
}