---
id: CVE-2017-20271
title: >-
  Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that
  allows unauthenticated attackers to execute arbitrary SQL queries by injecting
  malicious code through the catid parameter
summary: >-
  Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that
  allows unauthenticated attackers to execute arbitrary SQL queries by injecting
  malicious code through the catid parameter. Attackers can send GET requests to
  ind…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-89
vendor: nordmograph
product: streetguessr_game
affected:
  - streetguessr_game = 1.1.8
published: '2026-06-19'
updated: '2026-08-21'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-20271'
references:
  - url: 'https://www.exploit-db.com/exploits/42423'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/joomla-streetguessr-game-sql-injection-via-catid
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00294
epssPercentile: 0.22173
ingestedAt: '2026-08-22T13:32:34.733Z'
---

## Overview

Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parameter. Attackers can send GET requests to index.php with the option=com_streetguess&view=maps parameters and inject SQL code in the catid parameter to extract sensitive database information including version and database names.

## Affected

- `streetguessr_game = 1.1.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.