PT-2026-50964 · Cmsjunkie · Jhotelreservation

Ihsan Sencan · Publicado 2026-06-19 · Atualizado 2026-06-19 · CVE-2019-25748

Mitre

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rooms parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL payloads in the rooms parameter to extract sensitive database information including version details.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-25748

Produtos afetados

Jhotelreservation

Referências · 5

• 🔥 https://exploit-db.com/exploits/46234 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25748 · Nota de Segurança
• https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jhotelreservation · Nota
• https://vulncheck.com/advisories/joomla-jhotelreservation-sql-injection-via-search-hotels · Nota
• http://cmsjunkie.com · Nota