Joomla Component eXtroForms 2.1.5 is vulnerable to SQL injection through the filter_type_id, filter_pid_id, and filter_search parameters used by the extroformfield view. When an attacker submits a malicious payload in a POST request, arbitrary SQL statements can be executed against the database. This allows the attacker to read or modify any data stored by the Joomla site, including sensitive configuration, user credentials, or application data.

The vulnerability affects users who have installed eXtroForms version 2.1.5 on any Joomla-based website. The component is distributed by Extro as eXtroForms, and the defect exists specifically in the 2.1.5 release.

The CVSS score of 7.1 indicates a high severity risk, and the lack of an EPSS score means current exploitation probability is unknown but potential exists. The component requires the attacker to be authenticated, conveying that the threat is limited to sites where attackers can obtain a valid login. The vulnerability is not listed in the CISA KEV catalog, but the ability to execute arbitrary SQL commands makes it a serious threat to confidentiality and integrity of site data. A likely attack path involves an authenticated user sending a crafted POST request to the extroformfield view to extract sensitive database information.