nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-20271 CVE-2017-20271
HIGH
Joomla StreetGuessr Game 1.1.8 SQL Injection via catid
Record summary
CVE-2017-20271 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with the option=com_streetguess&view=maps parameters and inject SQL code in the catid parameter to extract sensitive database information including version and database names.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 23, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
StreetGuessr GameBrowse Nordmograph / StreetGuessr Game | CVE List | 1.1.8 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJoomla! Component StreetGuessr Game 1.1.8 - SQL InjectionExploitDB exploitby Ihsan SencanNot analyzed1 file
References
3ExploitDB-42423exploit
https://www.exploit-db.com/exploits/42423 VulnCheck Advisory: Joomla StreetGuessr Game 1.1.8 SQL Injection via catidThird-party advisory
https://www.vulncheck.com/advisories/joomla-streetguessr-game-sql-injection-via-catid