The Joomla Responsive Portfolio 1.6.1 extension has an SQL injection flaw that permits authenticated users to inject arbitrary SQL via filter parameters such as filter_type_id, filter_pid_id, and filter_search in POST requests. The failure to properly sanitize these inputs allows an attacker to execute any SQL statement against the database, potentially exposing credentials, server configuration details, and other sensitive data. This flaw falls under CWE-89, indicating an injection weakness in data handling.

The vulnerability impacts the Extro Responsive Portfolio extension, specifically version 1.6.1. It is present in Joomla sites that have installed this version of the plugin and are using it with user accounts that have permissions to submit filter queries.

The CVSS score of 7.1 indicates a high severity. While EPSS data is unavailable, the fact that only authenticated users can exploit the flaw limits the attack surface but still poses a significant risk for internal attackers. The vulnerability is not listed in CISA's KEV catalog. Attackers would need valid credentials and would send crafted POST requests to the filter handling endpoint to deliver malicious SQL.