Executive brief
A vulnerability exists in the RPC Responsive Portfolio extension for Joomla, which is used to display image and video galleries. An unauthorized attacker can exploit this flaw to access the website's underlying database. This could lead to the theft of sensitive information, including user credentials or site configuration data, potentially compromising the entire website.
Technical details
An SQL injection vulnerability exists in the RPC Responsive Portfolio (com_pofos) component version 1.6.1 for Joomla. The flaw is located in the 'id' parameter handled by the 'pofo' view. An unauthenticated remote attacker can exploit this by sending a specially crafted GET request to index.php (e.g., index.php?option=com_pofos&view=pofo&id=[SQL]). Successful exploitation allows the attacker to bypass input sanitization and execute arbitrary SQL commands, enabling the extraction of sensitive data from the database. No authentication or user interaction is required for exploitation.
Affected products
- eXtro.media RPC Responsive Portfolio 1.6.1
Timeline
- 2017-08-25: disclosed: Initial exploit published on Exploit-DB
- 2026-06-19: advisory: CVE published/updated in NVD dataset