PatchSiren cyber security CVE debrief
CVE-2017-20274 King-products CVE debrief
CVE-2017-20274 is an SQL injection vulnerability in Joomla LMS King Professional 3.2.4.0. Unauthenticated attackers can manipulate database queries by injecting SQL code through the cp_id parameter in GET requests to index.php with specific parameters. This issue has a CVSS score of 8.8 and is considered HIGH severity. Defenders should prioritize patching or mitigating this vulnerability to prevent potential data breaches.
- Vendor
- King-products
- Product
- LMS King Professional
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-19
- Original CVE updated
- 2026-06-23
- Advisory published
- 2026-06-19
- Advisory updated
- 2026-06-23
Who should care
Defenders responsible for Joomla LMS King Professional 3.2.4.0 installations should prioritize patching or mitigating this vulnerability. This includes IT administrators, cybersecurity teams, and developers who manage or maintain Joomla LMS King Professional installations. Additionally, security teams should monitor for potential exploitation attempts.
Technical summary
The vulnerability exists in Joomla LMS King Professional 3.2.4.0 and allows unauthenticated attackers to inject SQL code through the cp_id parameter. Attackers can send GET requests to index.php with the option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath parameters to extract sensitive database information. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
Defensive priority
High priority due to high CVSS score and potential for data breaches
Recommended defensive actions
- Apply patches or updates to Joomla LMS King Professional 3.2.4.0 to fix the SQL injection vulnerability
- Implement input validation and sanitization for user-supplied input
- Monitor for suspicious database activity and potential exploitation attempts
- Review and restrict access to sensitive database information
- Conduct a thorough vulnerability assessment and penetration testing
Evidence notes
The vulnerability is confirmed by CVE and NVD records. Exploit DB and Vulncheck provide additional references. The affected product and version are Joomla LMS King Professional 3.2.4.0. Defenders should verify the vulnerability and affected versions from official sources.
Official resources
This article is AI-assisted and based on the supplied source corpus.