CVE-2017-20271: SQL Injection in Joomla StreetGuessr Game 1.1.8

Technical summary

CVE-2017-20271 is an unauthenticated SQL injection vulnerability affecting Joomla StreetGuessr Game 1.1.8. The vulnerability exists in the component's map view functionality (com_streetguess&view=maps), where the catid parameter is not properly sanitized before being incorporated into SQL queries. Attackers craft GET requests to index.php with injected SQL payloads in the catid parameter, allowing arbitrary query execution. The vulnerability enables information disclosure through database enumeration, including extraction of version strings and database names. The flaw maps to CWE-89 (SQL Injection).

Business impact

Exploitation of this SQL injection could lead to unauthorized access to sensitive database information stored within Joomla installations running the vulnerable component. While the CVSS vector indicates limited impact on integrity and no availability impact, the high confidentiality impact means attackers can extract user credentials, personal data, configuration details, and other sensitive records. For organizations using this component, this poses a direct data breach risk that could trigger regulatory notification requirements and reputational damage. The ease of exploitation (no authentication required, network accessible) amplifies business risk.

Affected systems

Joomla StreetGuessr Game version 1.1.8 is confirmed vulnerable. Organizations should audit their Joomla installations for the presence of this component. The vulnerability affects any system running the vulnerable version that is accessible over the network, regardless of other security controls, since exploitation requires no authentication.

Exploitability

This vulnerability is highly exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network accessibility, low attack complexity, no privilege requirements, and no user interaction needed. An attacker can execute SQL injection attacks immediately upon discovering a target running the vulnerable component. Automated scanning tools can identify susceptible instances by checking for the presence of the StreetGuessr component and its version. No sophisticated techniques or insider knowledge is required.

Remediation

The primary remediation is to upgrade Joomla StreetGuessr Game to a patched version that addresses this SQL injection. Organizations should verify the availability of patched versions from the component vendor and apply the update as soon as feasible given the high exploitability. For systems where immediate patching is not possible, implement network-level controls to restrict access to the vulnerable component (e.g., WAF rules blocking requests to com_streetguess with suspicious catid parameters, IP whitelisting).

Patch guidance

Contact the StreetGuessr component vendor or consult the Joomla component update mechanism to identify and apply the patched version. Verify the installed version before patching (typically found in the component's manifest file or admin interface). After patching, confirm the component version has been updated and test basic functionality of the maps feature. Verify against the vendor advisory for the specific patched version number and any post-patch configuration requirements.

Detection guidance

Monitor web server access logs for GET requests to index.php containing option=com_streetguess&view=maps with unusual or SQL-like syntax in the catid parameter (e.g., single quotes, SQL keywords, comments). Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the catid parameter. Conduct log analysis for any successful exploitation attempts by searching for database error messages in application logs or unusual database query activity. Use vulnerability scanners that recognize the StreetGuessr component version to identify vulnerable instances in your environment.

Why prioritize this

This vulnerability warrants high priority due to its combination of ease of exploitation, high confidentiality impact, and lack of authentication requirements. Any attacker with network access can immediately attempt data extraction. The published date of June 2026 indicates this is a recently disclosed flaw, increasing the likelihood of active scanning and exploitation attempts. Organizations running the StreetGuessr component should treat this as an urgent remediation target.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects a network-accessible, unauthenticated attack requiring no user interaction, combined with high confidentiality impact (attackers can read database contents). The low integrity and no availability impact prevent a critical rating, but the ease of exploitation and direct data exposure risk justify the high severity classification.

Frequently asked questions