# CVE-2017-20266: Joomshaper SP Movie Database SQL injection in searchword parameter

Source: https://junglewise.ai/threats/cve-2017-20266-joomshaper-sp-movie-database-sql-injection-in-searchword  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2017-20266 · Severity: high · CVSS 8.2 · Published 2026-06-19

Joomshaper SP Movie Database is a Joomla extension used to manage and display movie directories. A security flaw in version 1.3 allows unauthorized individuals to run malicious database commands through the search feature. This could lead to the theft of sensitive information, such as user credentials or site configuration data, potentially compromising the entire website.

Vendors: [JoomShaper](https://junglewise.ai/threats/vendors/joomshaper).

## Quick answers

**Is CVE-2017-20266 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-20266 being exploited in the wild.

**How severe is CVE-2017-20266?** High severity, with a CVSS score of 8.2, published 19 June 2026.

**Which products and versions are affected?** JoomShaper SP Movie Database 1.3.

**Is there a fix for CVE-2017-20266?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-20266 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-20266?** Check whether you run JoomShaper SP Movie Database at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in the Joomshaper SP Movie Database extension version 1.3 for Joomla. The flaw is located in the 'searchresults' view, where the 'searchword' parameter is not properly sanitized before being used in a database query. An unauthenticated remote attacker can exploit this by sending a specially crafted GET request containing SQL payloads. Successful exploitation allows the attacker to extract sensitive information from the database or execute arbitrary SQL commands. The vulnerability was publicly documented with a proof-of-concept exploit in 2017, though the CVE was formally assigned later.

## Affected products

- Joomshaper SP Movie Database 1.3

## Timeline

- 2017-08-18: disclosed: Exploit-DB entry published by Ihsan Sencan
- 2026-06-19: advisory: CVE record published by VulnCheck/NVD

## References

- [http://joomshaper.com/](http://joomshaper.com/)
- [https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/sp-movie-database/](https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/sp-movie-database/)
- [https://www.exploit-db.com/exploits/42502](https://www.exploit-db.com/exploits/42502)
- [https://www.vulncheck.com/advisories/joomla-sp-movie-database-sql-injection-via-searchword](https://www.vulncheck.com/advisories/joomla-sp-movie-database-sql-injection-via-searchword)