Executive brief
Quiz Deluxe, a Joomla extension used for creating online quizzes and assessments, contains a security flaw that allows unauthorized individuals to access its database. By sending specially crafted web requests, an attacker can bypass security controls to view, modify, or delete sensitive information stored in the website's database. This could lead to the exposure of user data, quiz results, or administrative credentials, potentially compromising the entire website.
Technical details
An SQL injection vulnerability exists in the JoomPlace Quiz Deluxe component (com_joomlaquiz) for Joomla, specifically within the 'ajaxaction.flag_question' task. The issue stems from improper sanitization of the 'stu_quiz_id' and 'flag_quest' parameters. An unauthenticated remote attacker can exploit this by sending crafted HTTP GET requests to the vulnerable endpoint, allowing for the execution of arbitrary SQL commands. This can be leveraged to extract sensitive data from the database via boolean-based or error-based injection techniques. The vulnerability was publicly documented with a proof-of-concept exploit in 2017, and the extension has since been unpublished from the Joomla Extensions Directory.
Affected products
- JoomPlace Quiz Deluxe 3.7.4 and earlier
Timeline
- 2017-08-30: disclosed: Public exploit released on Exploit-DB
- 2026-06-19: advisory: CVE published and NVD record created