CVE-2017-20279 Overview
CVE-2017-20279 is a SQL injection vulnerability in the Joomla Payage 2.05 extension. The flaw exists in the aid parameter processed by the make_payment task within index.php. Unauthenticated attackers can inject arbitrary SQL into backend database queries through crafted GET requests. Exploitation supports boolean-based blind and time-based blind techniques, enabling extraction of sensitive database contents. The vulnerability is classified under CWE-89 and is exploitable remotely over the network without user interaction.
Critical Impact
Unauthenticated remote attackers can extract arbitrary data from the Joomla database, including credentials and session material, by injecting SQL through the aid parameter.
Affected Products
- Joomla Payage extension version 2.05
- Joomla CMS installations with the Payage component enabled
- Web applications exposing the com_payagemake_payment task
Discovery Timeline
- 2026-06-19 - CVE-2017-20279 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2017-20279
Vulnerability Analysis
The Payage 2.05 extension for Joomla fails to sanitize the aid request parameter before incorporating it into a SQL query. When a client invokes the make_payment task on index.php, the component passes the attacker-controlled aid value directly into the database layer. This allows arbitrary SQL fragments to be concatenated into the executed statement. The defect maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
Root Cause
The root cause is missing input validation and a lack of parameterized queries in the Payage component. The aid parameter is treated as trusted input and inserted into a dynamically built SQL string. No type casting, escaping, or prepared statement binding is applied before query execution.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker issues HTTP GET requests to index.php specifying the Payage component and the make_payment task, with a malicious payload in the aid parameter. Because the response timing and content vary with the injected SQL, the flaw supports both boolean-based blind and time-based blind extraction. Tooling such as automated SQL injection scanners can enumerate tables, columns, and rows without producing visible error output.
No verified proof-of-concept code is reproduced here. Refer to the Exploit-DB entry #42113 and the VulnCheck Advisory on Joomla Payage SQL Injection for request-level details.
Detection Methods for CVE-2017-20279
Indicators of Compromise
- GET requests to index.php containing option=com_payage and task=make_payment with SQL metacharacters in the aid parameter.
- Web server access logs showing aid values that include UNION, SELECT, SLEEP(, BENCHMARK(, AND 1=1, or encoded equivalents.
- Abnormally long response times correlated with requests to the Payage make_payment endpoint, consistent with time-based blind injection.
- Database error entries referencing the Payage component or unexpected query fragments.
Detection Strategies
- Inspect HTTP logs for repeated requests to the com_payagemake_payment task originating from a single source within short time windows.
- Deploy web application firewall (WAF) rules that flag SQL syntax tokens in the aid query string parameter.
- Correlate Joomla application logs with database query logs to identify malformed or unusually structured statements targeting Payage tables.
Monitoring Recommendations
- Enable verbose query logging on the Joomla database and alert on statements containing concatenated boolean tautologies or sleep functions.
- Monitor outbound traffic from the web server for anomalous data egress following requests to the Payage component.
- Track failed and successful authentication events that occur shortly after suspicious aid parameter activity, which may indicate credential extraction.
How to Mitigate CVE-2017-20279
Immediate Actions Required
- Disable the Payage 2.05 extension in the Joomla administrator console until a fixed version is confirmed available.
- Block or rate-limit external access to index.php?option=com_payage&task=make_payment at the reverse proxy or WAF layer.
- Review database audit logs for evidence of prior exploitation and rotate any credentials, API keys, or tokens stored in the affected database.
Patch Information
No vendor patch reference is included in the NVD entry for CVE-2017-20279. Administrators should consult the Joomla extensions directory and the VulnCheck Advisory on Joomla Payage SQL Injection for current remediation status. If a fixed release is unavailable, removal of the Payage component is recommended.
Workarounds
- Uninstall the Payage component if a payment workflow alternative exists.
- Add WAF signatures that reject non-numeric values in the aid parameter, since the field is expected to be an integer identifier.
- Restrict access to the make_payment task to authenticated sessions through Joomla access control list (ACL) configuration where possible.
- Apply virtual patching at the proxy layer to enforce strict input typing on Joomla request parameters until the component is updated or removed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
