CVE-2017-8917: Joomla! 3.7.x unauthenticated SQL injection in core component

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityUnauthenticated remote SQL injection with a 9.8 CVSS score, public exploit code and an EPSS probability above 0.99 makes this an urgent patch-first issue.

What it is

Joomla! 3.7.x before 3.7.1 contains a SQL injection flaw in a core component that lets an attacker run arbitrary SQL commands. The record does not name the vulnerable component or the exact request parameter, but the flaw is remotely reachable without credentials and carries a critical CVSS score of 9.8. Because Joomla is widely deployed and public exploit code exists, unpatched sites are at immediate risk.

Impact

An attacker can read, modify or delete data in the Joomla database, including user credential hashes and session data, and can potentially pivot to further compromise of the site or its host. Full confidentiality, integrity and availability impact is scored.

Attack surface

Reachable over the network via HTTP against the Joomla front end; the CVSS vector shows no privileges required and no user interaction, so the vulnerable endpoint is hit directly. The specific route and parameter are not given in the record.

Exploitation

Public exploit code is referenced on Exploit-DB, and EPSS is 0.99826 (99.959th percentile), indicating near-certain exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild federal tracking is available from this record.

What to do

• Upgrade Joomla! to 3.7.1 or later immediately; this is the vendor-patched fix.
• If immediate upgrade is impossible, take the site offline or place it behind a WAF rule blocking SQL injection patterns against Joomla endpoints.
• Audit the database and Joomla admin accounts for unauthorized changes or added users after any exposure window.
• Rotate database credentials and Joomla secret keys if compromise is suspected.
• Verify no other Joomla 3.7.x instances remain in the environment, including staging and archived copies.

Detection

• Search web server logs for requests to Joomla endpoints containing SQL keywords, UNION, or comment sequences from single source IPs.
• Monitor database logs for anomalous SELECT, UNION, or stacked queries originating from the web application account.
• Alert on creation of new Joomla super user accounts or unexpected changes to the users table.
• Use file integrity monitoring on Joomla core and extension directories to catch post-exploitation webshell drops.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.