CVE-2017-20274: Joomla LMS King SQL Injection Vulnerability – Unauthenticated Database Access

Technical summary

The vulnerability exists in the LMS King component's learning path functionality. When the component processes the cp_id parameter in GET requests to index.php (with option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath), the application fails to properly sanitize or parameterize the input before constructing SQL queries. This allows an attacker to inject arbitrary SQL syntax, enabling unauthorized data extraction. The attack surface is the public-facing web endpoint with no authentication requirement, making it remotely exploitable over the network.

Business impact

An attacker exploiting this flaw gains read access to the Joomla database, potentially exposing user credentials, personal information, course enrollment data, and other sensitive records stored by the LMS. While the vulnerability does not directly enable database modification or deletion (based on the CVSS vector), the confidentiality breach alone can lead to regulatory violations (GDPR, HIPAA, depending on data), reputational damage, and loss of student/customer trust. Organizations hosting training or educational platforms on affected versions face immediate risk of data exposure.

Affected systems

Joomla LMS King Professional version 3.2.4.0 is confirmed vulnerable. No vendor product list was provided in the source data; organizations should verify their exact component version in the Joomla administrator panel under Extensions > Manage Extensions and cross-reference with the component's official release notes to determine if they are running the affected release or a patched successor.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and network access only—a low bar for an internet-facing Joomla site. Crafting a malicious request is straightforward once the vulnerable parameters are known, and the impact (data extraction) is immediate. No exploit code is required beyond standard HTTP GET requests with SQL syntax. This combination of low attack complexity and direct data access makes the vulnerability attractive to attackers.

Remediation

The primary remediation is to upgrade Joomla LMS King Professional to a patched version released after 3.2.4.0. Consult the official LMS King or Joomla security advisories for the specific patch version number and compatibility notes. As an interim measure, consider restricting web access to the vulnerable com_lmsking component at the web application firewall or reverse proxy level, though this is not a substitute for patching. Verify that the component is necessary; if not, disable or uninstall it entirely.

Patch guidance

Obtain and apply the latest patched version of LMS King Professional from the official vendor. Before deploying to production, test the patch in a staging environment to ensure compatibility with your Joomla version, database, and any customizations. Review the vendor's changelog to confirm the SQL injection fix is included. Once patched, validate that the learning path functionality operates normally and that the vulnerable cp_id parameter is now safely handled. Establish a process to monitor for future security updates from the vendor.

Detection guidance

Monitor HTTP request logs for GET requests to index.php containing suspicious parameter patterns, particularly those with option=com_lmsking and layout=learningpath combined with unusual cp_id values containing SQL keywords (SELECT, UNION, OR, --) or special characters (quotes, semicolons, comment symbols). Web application firewalls can be configured with rules to block requests matching SQL injection signatures. Additionally, enable database query logging and search for unexpected SELECT statements originating from the web application user account. Conduct a database access audit to identify any tables that may have been queried by unauthorized requests.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.2), unauthenticated network exploitability, and direct data confidentiality impact. Organizations running Joomla LMS platforms handle sensitive educational and personal data; a breach affects both institutional compliance and user privacy. The ease of exploitation and lack of known workarounds make it a priority for rapid patching cycles.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects: (AV:N) network-based attack requiring no special access, (AC:L) low attack complexity with no special conditions, (PR:N) no privilege requirement, (UI:N) no user interaction needed, (S:U) impact limited to the vulnerable component, (C:H) high confidentiality impact through unauthorized data access, (I:L) low integrity impact (no direct modification capability shown), and (A:N) no availability impact. The high confidentiality score dominates the rating due to unrestricted database read access.

Frequently asked questions