CVE-2018-25381: Joomla Responsive Portfolio SQLi Flaw

CVE-2018-25381 Overview

CVE-2018-25381 is a SQL injection vulnerability in the Joomla Responsive Portfolio extension version 1.6.1. The flaw allows authenticated attackers to inject arbitrary SQL commands through the filter_type_id, filter_pid_id, and filter_search POST parameters. Successful exploitation enables extraction of sensitive database content including user credentials, session data, and server configuration details. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). The issue affects sites running the Responsive Portfolio Component (RPC) extension distributed through the Joomla Extensions Directory.

Critical Impact

Authenticated attackers can exfiltrate database contents, including credentials and server metadata, by injecting SQL payloads into filter parameters.

Affected Products

• Joomla Responsive Portfolio extension version 1.6.1
• Joomla CMS installations using the RPC Responsive Portfolio component
• Web servers hosting vulnerable Joomla instances with the extension enabled

Discovery Timeline

• 2026-05-25 - CVE-2018-25381 published to the National Vulnerability Database
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25381

Vulnerability Analysis

The Responsive Portfolio extension fails to sanitize user-supplied input before incorporating it into SQL queries. Three POST parameters accept attacker-controlled data without parameterization or escaping: filter_type_id, filter_pid_id, and filter_search. An authenticated user with low privileges can submit crafted POST requests to trigger the injection. The database backend interprets injected SQL fragments as part of the original query, allowing UNION-based or boolean-based extraction techniques. Public exploitation details are documented in Exploit-DB #45491 and the VulnCheck Joomla Advisory.

Root Cause

The extension concatenates filter parameter values directly into SQL statements instead of using prepared statements or Joomla's database abstraction layer with bound parameters. This violates secure coding practices defined under [CWE-89] and exposes the underlying MySQL database to direct manipulation.

Attack Vector

The attack is delivered over the network and requires low-privilege authentication. An attacker sends a POST request containing SQL syntax in any of the three vulnerable filter parameters. The response surface enables in-band data extraction through UNION SELECT payloads or blind techniques using conditional time delays. No user interaction is required beyond the attacker's own authenticated session.

No verified code examples are available for this vulnerability. Refer to the Exploit-DB #45491 entry for proof-of-concept request structure and parameter payloads.

Detection Methods for CVE-2018-25381

Indicators of Compromise

• POST requests to Responsive Portfolio endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in filter_type_id, filter_pid_id, or filter_search parameters.
• Unexpected database queries against the users table or #__users Joomla table originating from the component endpoint.
• Web server access logs showing repeated POST requests with encoded SQL metacharacters such as %27, %20OR%20, or --.

Detection Strategies

• Deploy web application firewall (WAF) rules that inspect POST bodies for SQL injection signatures targeting the three filter parameters.
• Enable Joomla's database query logging and alert on queries containing concatenated user input from extension endpoints.
• Correlate authentication events with anomalous query patterns to identify low-privilege accounts performing reconnaissance.

Monitoring Recommendations

• Monitor outbound network traffic from the database server for unusual data volume that may indicate exfiltration.
• Track failed and successful queries against sensitive tables, including the Joomla user store.
• Review newly created administrator accounts and modified session records following suspicious POST activity.

How to Mitigate CVE-2018-25381

Immediate Actions Required

• Disable or uninstall the Responsive Portfolio extension version 1.6.1 until a patched release is confirmed.
• Restrict access to the Joomla administrator panel and component endpoints using IP allowlisting where feasible.
• Audit existing Joomla user accounts for unauthorized privilege changes or unexpected logins.

Patch Information

No vendor patch is referenced in the available CVE data. Site administrators should consult the Joomla Extension Overview and the Extro Media Resource for current release status. If no fixed version is available, removal of the extension is the recommended remediation.

Workarounds

• Apply WAF signatures that block SQL metacharacters in filter_type_id, filter_pid_id, and filter_search POST parameters.
• Enforce least-privilege database accounts for the Joomla application, removing rights to system tables and administrative functions.
• Rotate credentials and session secrets if exploitation is suspected based on log review.

# Example WAF rule (ModSecurity) blocking SQL injection in vulnerable parameters
SecRule ARGS:filter_type_id|ARGS:filter_pid_id|ARGS:filter_search \
    "@rx (?i)(union[\s\+]+select|sleep\(|information_schema|--|';)" \
    "id:1002581,phase:2,deny,status:403,log,msg:'CVE-2018-25381 SQLi attempt'"