Executive brief
Gegabyte User Bench is a directory extension for the Joomla content management system. A security flaw in this component allows an attacker to access and extract sensitive information from the website's database without needing a password. This could lead to the theft of user credentials, site configuration details, and other private data stored on the server.
Technical details
An SQL injection vulnerability exists in the Gegabyte User Bench 1.0 component for Joomla. The flaw is located in the 'userid' parameter handled by index.php when the 'option' is set to 'com_userbench' and 'view' is set to 'detail'. Because the application fails to properly sanitize this input, an unauthenticated remote attacker can append malicious SQL commands to GET requests. Successful exploitation allows for the extraction of sensitive data from the underlying database, including administrative credentials and system configuration. The extension has been unpublished from the Joomla Extension Directory, and users are advised to discontinue its use.
Affected products
- Gegabyte User Bench 1.0
Timeline
- 2017-12-18: disclosed: Initial exploit code published by researcher Ihsan Sencan
- 2026-06-19: advisory: CVE-2017-20254 published via VulnCheck/NVD