CVE-2017-20258: Joomla RPC Portfolio SQLi Vulnerability

CVE-2017-20258 Overview

CVE-2017-20258 is a SQL injection vulnerability in the Joomla! Component RPC Responsive Portfolio version 1.6.1. The flaw resides in the id parameter handled by the com_pofos component. Unauthenticated remote attackers can inject arbitrary SQL through crafted GET requests to index.php with the query string option=com_pofos&view=pofo&id=[SQL]. Successful exploitation exposes backend database contents, including credentials, session data, and configuration values. The issue is tracked under CWE-89 for improper neutralization of special elements used in an SQL command.

Critical Impact
Unauthenticated attackers can read arbitrary database contents from Joomla sites running the affected extension by manipulating a single URL parameter.

Affected Products

Joomla! Component RPC Responsive Portfolio 1.6.1
Joomla! installations bundling the com_pofos extension
Sites distributed via Extro Media using the affected portfolio component

Discovery Timeline

2026-06-19 - CVE-2017-20258 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2017-20258

Vulnerability Analysis

The RPC Responsive Portfolio component accepts the id query parameter without sanitization before concatenating it into a database query. The endpoint reachable at index.php?option=com_pofos&view=pofo&id=[SQL] returns rendered portfolio content keyed on this identifier. Because the parameter is interpolated directly into the SQL statement, attackers can break out of the integer context and append UNION SELECT payloads or boolean-based predicates. The vulnerability requires no authentication, no user interaction, and can be triggered over the network against any reachable site running the component. A public proof of concept is published as Exploit-DB #42564.

Root Cause

The component fails to apply parameterized queries or input validation when handling the id parameter. Joomla provides the JDatabaseQuery API with prepared statement binding, but the affected code path concatenates user-controlled data into raw SQL. This pattern is a textbook CWE-89 violation.

Attack Vector

The attacker submits a single HTTP GET request to the vulnerable endpoint with SQL syntax embedded in the id parameter. Typical payloads use UNION SELECT to enumerate the #__users table or stack tautological conditions to confirm injection. No credentials, cookies, or prior session state are required. Additional context is available in the VulnCheck Advisory on Joomla SQL Injection and the Joomla Extension Overview.

Detection Methods for CVE-2017-20258

Indicators of Compromise

HTTP requests to index.php containing option=com_pofos&view=pofo&id= with SQL keywords such as UNION, SELECT, SLEEP, or CONCAT.
Web server access logs showing unusually long or URL-encoded values for the id parameter from a single source IP.
Database error messages in application logs referencing syntax errors near the pofo query.
Unexpected outbound queries against the #__users or #__session tables originating from the Joomla web user.

Detection Strategies

Deploy web application firewall rules that flag SQL metacharacters in the id parameter of com_pofos requests.
Enable Joomla debug logging and alert on database errors traceable to the portfolio component.
Correlate spikes in 500-class responses from index.php?option=com_pofos with repeated requests from the same client.

Monitoring Recommendations

Forward Apache or Nginx access logs to a centralized SIEM and apply parsers that extract the option, view, and id query parameters.
Monitor MySQL or MariaDB general query logs for SELECT statements containing payload fragments such as 0x hex strings or information_schema references.
Track authentication anomalies on Joomla administrator accounts that could indicate stolen password hashes.

How to Mitigate CVE-2017-20258

Immediate Actions Required

Disable the RPC Responsive Portfolio component in the Joomla Extension Manager until a fix is verified.
Block requests containing option=com_pofos&view=pofo&id= with non-numeric values at the WAF or reverse proxy.
Audit the #__users table for unauthorized administrator accounts and rotate all Joomla credentials.
Review database logs for evidence of prior exploitation against the pofo endpoint.

Patch Information

No vendor patch is referenced in the published advisory. Operators should remove the extension or replace it with a maintained portfolio component. Refer to the VulnCheck advisory and Exploit-DB #42564 for the technical proof of concept used to validate any remediation.

Workarounds

Uninstall the com_pofos component and remove residual database tables prefixed with #__pofos.
Enforce an integer-only allowlist regex on the id parameter at the WAF layer, for example ^[0-9]+$.
Restrict access to index.php?option=com_pofos to trusted IP ranges if the component cannot be removed immediately.
Apply Joomla database account least privilege so the web user cannot read sensitive tables beyond what the application requires.

bash

# Example ModSecurity rule to block SQLi against com_pofos
SecRule ARGS:id "!@rx ^[0-9]+$" \
  "id:1002017,phase:2,deny,status:403,\
  msg:'CVE-2017-20258 - Non-numeric id parameter for com_pofos',\
  chain"
  SecRule ARGS:option "@streq com_pofos"