Executive brief
eXtro.media Responsive Portfolio is a Joomla extension used to create and manage image galleries and portfolios on websites. A security flaw in this component allows a logged-in user with basic permissions to access sensitive information from the website's database. This could lead to the theft of administrative credentials, customer data, or other confidential server information.
Technical details
An SQL injection vulnerability exists in the eXtro.media Responsive Portfolio component (com_pofos) version 1.6.1 for Joomla. The flaw is located in the administrative interface (administrator/index.php) and is triggered via POST requests to the 'pofoits' view. Multiple parameters, including 'filter_type_id', 'filter_pid_id', and 'filter_search', fail to properly neutralize special elements before using them in SQL queries. An authenticated attacker with access to the filtering features can perform boolean-based blind, error-based, or time-based blind SQL injection. This allows for the extraction of sensitive database content, including user credentials and server configuration details.
Affected products
- eXtro.media Responsive Portfolio 1.6.1
Timeline
- 2018-09-25: disclosed: Initial exploit published on Exploit-DB
- 2026-05-25: advisory: CVE record published/updated via VulnCheck