Official Product Homepageproduct
http://focalpointx.com/ CVE-2017-20263
HIGH
Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location
Record summary
CVE-2017-20263 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_focalpoint, view=location, and a crafted id parameter containing SQL commands to extract sensitive database information.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 22, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
FocalPoint Pro / FreeBrowse Focalpointx / FocalPoint Pro / Free | CVE List | 1.2.3 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJoomla! Component FocalPoint 1.2.3 - SQL InjectionExploitDB exploitby Ihsan SencanNot analyzed1 file
References
5Product Referenceproduct
http://focalpointx.com/demos/focalpoint-pro nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-20263 ExploitDB-42530exploit
https://www.exploit-db.com/exploits/42530 VulnCheck Advisory: Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via locationThird-party advisory
https://www.vulncheck.com/advisories/joomla-focalpoint-pro-free-sql-injection-via-location