CVE-2017-20274: Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-19 · updated 2026-08-19
Weakness: CWE-89

Description

Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cp_id parameter. Attackers can send GET requests to index.php with the option=com_lmsking, view=lmsking, layout=learningpath, and task=learningPath parameters to extract sensitive database information.

Affected products

King-products LMS King Professional: 3.2.4.0

References

https://www.exploit-db.com/exploits/42415
https://www.vulncheck.com/advisories/joomla-lms-king-professional-sql-injection-via-learningpath

Get alerted when CVE-2017-20274 or the next vulnerability affects your stack