My server is running Sitelock Pro which has identified a high priority security vulnerability. I am using Joomla 3.5.1. They have reported the following as a potential CGI Generic SQL Injection Issue.

Using the GET HTTP method, SiteLock found that :

+ The following resources may be vulnerable to blind SQL injection : + The 'view' parameter of the /index.php CGI :

/index.php?password=&username=&task=user.login&return=aHR0cDovL2Fnc2hvd3 Nuc3cub3JnLmF1Lw%3d%3d&remember=yes&846aab23bf47149946862bda9334e253=1&a 3eed60704e56fd53c721c36000f958c=1&format=json&option=com_ajax&view=remin d)+or+(1=1

-------- output --------

HTTP/1.1 200 OK

-------- vs --------

HTTP/1.1 406 Not Acceptable

Any idea on what is causing this and how to fix it?

  • 3
    If it's saying it's part of the Joomla core, please do not post about it on here, but instead contact the Joomla security strike team.
    – Lodder
    Commented May 6, 2016 at 8:35

2 Answers 2


Really really simple solution and cant believe no one has said it. Upgrade to the latest version of Joomla. You are many versions behind


I don't think there's an issue there. The request is routed to com_ajax which will always return HTTP 200 when valid format is specified (as it is in this request). But it won't do anything, there's no module or plugin in the request to be called, so com_ajax will just return an empty result set, $results is null here, nothing was processed:

case 'json' :
        echo new JResponseJson($results, null, false, $input->get('ignoreMessages', true, 'bool'));


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.