Joomla Component eXtroForms 2.1.5 SQL Injection via filter parameters

Vulnerability

Joomla Component eXtroForms version 2.1.5 contains SQL injection vulnerabilities in the filter_type_id, filter_pid_id, and filter_search parameters. These parameters are accessible via POST requests to the extroformfield view in the backend (/administrator/index.php?option=com_extroform&view=extroformfield). The vulnerability requires an authenticated user with access to the filtering feature; no special privileges beyond a standard backend account are needed [1][3].

Exploitation

An authenticated attacker can craft a POST request with malicious SQL payloads in any of the three vulnerable parameters (filter_type_id, filter_pid_id, filter_search). The exploit demonstrated includes boolean-based blind and error-based techniques. For example, using a payload such as filter_type_id=-7022 OR 5787=5787# triggers a boolean-based blind SQL injection. The attacker must have a valid session cookie and be able to send POST requests to the vulnerable endpoint [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL commands against the Joomla database. With database access, the attacker can extract sensitive information such as user credentials, session data, and other server information. The impact includes data breach and potential privilege escalation within the Joomla application, depending on the database content [1][3].

Mitigation

As of the available references, no official patch or fixed version has been released. The vendor homepage (eXtro.media) does not mention an update addressing this vulnerability [2]. Users should restrict access to the administrator backend, apply principle of least privilege for backend users, and consider using a web application firewall (WAF) to filter SQL injection attempts. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.