CVE-2017-20278: Joomla JoomRecipe SQLi Vulnerability

CVE-2017-20278 Overview

CVE-2017-20278 is an SQL injection vulnerability [CWE-89] in the Joomla JoomRecipe component version 1.0.3. The flaw resides in the handling of the category parameter on the all-recipes endpoint. Unauthenticated attackers can inject SQL payloads through the category path segment using GET requests. Successful exploitation allows attackers to manipulate backend database queries and extract sensitive information stored in the Joomla database.

Critical Impact
Unauthenticated remote attackers can extract arbitrary data from the Joomla database, including user credentials, session data, and configuration secrets, by injecting SQL through the category URL parameter.

Affected Products

Joomla Component JoomRecipe 1.0.3
Joomla CMS installations with the JoomRecipe extension enabled
Web applications exposing the all-recipes endpoint via the vulnerable component

Discovery Timeline

2026-06-19 - CVE-2017-20278 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20278

Vulnerability Analysis

The JoomRecipe component fails to sanitize user-supplied input passed through the category URL segment before incorporating it into SQL queries. The component constructs database queries using string concatenation rather than parameterized statements. Attackers send crafted GET requests to the all-recipes/<category> endpoint, embedding SQL syntax such as UNION SELECT clauses or boolean conditions within the path. The database server then executes the attacker-controlled SQL alongside the intended query, returning data that the application reflects in responses or uses for further processing.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The category parameter is passed directly into a query without input validation, type enforcement, or prepared statement binding. Joomla's database abstraction layer offers safe query interfaces, but the JoomRecipe extension bypasses them for this code path. Any character — including single quotes, comments, and SQL keywords — reaches the database driver intact.

Attack Vector

Exploitation requires only network access to the Joomla site. No authentication, user interaction, or elevated privileges are needed. An attacker issues an HTTP GET request to the all-recipes/ route with a malicious payload in the category path segment. Time-based, boolean-based, and UNION-based SQL injection techniques are all viable. Public exploitation details are documented in Exploit-DB #42185 and the VulnCheck Joomla Advisory.

Detection Methods for CVE-2017-20278

Indicators of Compromise

HTTP GET requests to /all-recipes/ paths containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or -- comment sequences
Unusual outbound responses with database error strings or unexpected row counts from the JoomRecipe endpoint
Web server access logs showing repeated probing of the category parameter from a single source
Spikes in database query latency correlated with requests to recipe URLs

Detection Strategies

Inspect web server and reverse proxy logs for SQL keywords appearing in the URL path of JoomRecipe endpoints
Deploy web application firewall (WAF) rules to flag SQL injection patterns in path segments rather than only query strings
Correlate Joomla application errors with corresponding HTTP requests to identify exploitation attempts
Monitor database query logs for malformed or unusually long queries originating from the JoomRecipe component

Monitoring Recommendations

Enable verbose logging on the Joomla site and forward HTTP and database telemetry to a centralized analytics platform
Alert on responses larger than expected from the all-recipes endpoint, which may indicate data exfiltration via UNION-based injection
Track repeated 500-series errors from JoomRecipe URLs that often accompany failed injection probes

How to Mitigate CVE-2017-20278

Immediate Actions Required

Disable or uninstall the JoomRecipe 1.0.3 extension until a patched version is confirmed available
Restrict access to the /all-recipes/ endpoint at the WAF or reverse proxy until remediation is complete
Audit the Joomla database for unauthorized access, modified accounts, and exposed credentials
Rotate Joomla administrator passwords and any database secrets that may have been exposed

Patch Information

No vendor advisory or fixed version is referenced in the available data. Administrators should consult the VulnCheck Joomla Advisory and the JoomRecipe vendor for updates. If no patched release exists, removing the extension is the recommended path.

Workarounds

Block requests containing SQL metacharacters in the path segment of JoomRecipe URLs using WAF rules
Place the Joomla site behind authentication or IP allowlisting if the recipe functionality is non-public
Apply virtual patching through a reverse proxy to reject GET requests where the category segment contains characters outside an alphanumeric and hyphen allowlist

bash

# Example nginx rule rejecting suspicious category segments
location ~* ^/all-recipes/ {
    if ($request_uri ~* "(\'|\"|--|/\*|union|select|sleep\(|benchmark\()") {
        return 403;
    }
}