Unpacking CVE-2017–8917: A Hands-On Guide to Reproducing and Fixing the Joomla com_fields SQL…

Reproducing historical vulnerabilities is one of the most effective ways to transition from theoretical cybersecurity concepts to practical engineering defense. Classrooms often rely on friendly, purpose-built targets with clear narratives and debug panels. Real-world software, however, offers no such hand-holding. This post walks through the end-to-end reproduction, exploitation, and remediation of CVE-2017–8917, a critical error-based SQL injection vulnerability affecting Joomla! 3.7.0.

CVE-2017–8917 is a critical flaw residing in Joomla's com_fields component, scoring a maximum 9.8 (Critical) on the CVSS 3.0 scale. The component builds the ORDER BY clause of an internal database query directly from the list[fullordering] request parameter without routing it through Joomla's standard input-filtering whitelist. Because the unsanitized input sits inside an ORDER BY clause rather than a WHERE clause, traditional UNION SELECT techniques do not apply. Instead, attackers use an error-based SQL injection. By injecting functions like extractvalue() or updatexml() into the sort expression, the MySQL server evaluates the payload, fails to parse it as a valid XPath expression, and reflects the extracted database content back inside its own error message. Because default Joomla configurations surface PHP and MySQL errors directly to the client, this error message acts as an unintended exfiltration channel. The metric values driving this high severity score are No Privileges Required and No User Interaction Required. The com_fields list view is reachable pre-login. Consequently, any unauthenticated attacker on the public internet can leverage this single endpoint to read arbitrary data from the underlying database without needing an existing account.

Safety and isolation are prerequisites for any offensive security exercise. To prevent exposing a host system or local network, the lab environment was built inside an isolated virtual machine. The setup used Oracle VirtualBox running a 64-bit Kali Linux guest operating system, with the VM's network adapter locked to NAT to ensure the guest had no reachable IP address on the real Local Area Network. A clean snapshot was captured prior to deploying any software, enabling rapid rollbacks if configurations went sideways. Docker and Docker Compose were installed within the Kali VM to spin up the target container pinned precisely to joomla:3.7.0 paired with a mysql:5.7 database backend.

Before attempting any exploitation, it is vital to verify that the service is running normally so that subsequent anomalies can be definitively attributed to the exploit rather than a broken installation. A preliminary curl request to the server confirmed a healthy HTTP/1.1 200 OK status alongside standard Apache and PHP headers. Inspecting the version file inside the container returned RELEASE = '3.7' and DEV_LEVEL = '0', validating that the unpatched target was active and responsive.

Exploiting this bug requires careful handling of HTTP requests and URL parameters. First, the /installation/ directory must be removed and configuration.php must be present, otherwise Joomla redirects all traffic to the setup wizard. Second, curl interprets square brackets as glob ranges by default, which mangles requests; using the -g flag and URL-encoding brackets as %5B and %5D ensures the payload reaches the server intact. Defining the base URL targeting the com_fields endpoint allowed for systematic testing.

To prove arbitrary SQL execution, an extractvalue() function wrapping a version query was injected into the ordering parameter. The database version (5.7.44) leaked directly inside the HTML title element of the error response, encapsulated by tilde (0x7e) delimiters. Next, querying the database user and schema name revealed joomla@172.18.0.x and joomladb. Because extractvalue() truncates its output at 32 characters, the 60-character bcrypt password hash for the administrator account was pulled in 32-character fragments using SUBSTRING(). Stitching the resulting fragments together yielded the full administrator username and bcrypt hash (admin:$2y$10$...), which an attacker could then take offline to crack with commodity hardware.

CVE-2017–8917 was officially patched in the Joomla 3.7.1 source release via rigorous input validation on the ordering parameter. Because Docker Hub publishes joomla:3.7.3 as the earliest accessible patched image tag containing the fix, the service definition in docker-compose.yml was updated from 3.7.0 to 3.7.3. After pulling the patched container and resetting the database volume, re-running the exact same exfiltration request produced no output. The XPath error was gone, no database version was leaked, and the injection vector was fully sealed.

Analyzing real-world vulnerabilities highlights critical lessons for blue teams and security engineers. A single unvalidated parameter in a minor component can bypass authentication entirely and expose core database assets. Defenders monitoring Apache access logs can spot exploitation attempts by searching for requests targeting index.php?option=com_fields where the list[fullordering] parameter contains SQL functions like extractvalue, updatexml, concat, or substring. An unexpected spike in HTTP 500 error responses on this endpoint serves as an early indicator of automated probing. Finally, Web Application Firewalls (WAFs) configured to reject non-integer or unexpected structural values within sorting parameters can neutralize vulnerabilities during the critical window between public disclosure and patch deployment.