CVE-2019-25749: Joomla J-CruisePortal 6.0.4 SQL Injection via cruises
Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the guestadult parameter. Attackers can send POST requests to the cruises endpoint with crafted SQL payloads in the guestadult parameter to extract sensitive database information or manipulate database records.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla J-CruisePortal 6.0.4from your environment.If J-CruisePortal 6.0.4 is not required, uninstall/remove the J-CruisePortal extension to eliminate the vulnerable component until a vendor fix is available.
- Configuration
Disable POST handling for the /cruises endpoint or disable processing of the guest_adult parameter to prevent injection until a vendor patch is available.
Joomla J-CruisePortal (cruises endpoint) cruises POST handling / guest_adult parameter processing = disabled - Compensating control
Apply network-level or application-layer controls to block exploit attempts against the /cruises endpoint: restrict access to the endpoint to trusted IPs, place the endpoint behind a WAF with SQL injection protections, or block POST requests to the endpoint until a fix is deployed.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25749?
The severity of CVE-2019-25749 is rated high with a score of 7.1.
How does CVE-2019-25749 affect Joomla J-CruisePortal?
CVE-2019-25749 affects Joomla J-CruisePortal by allowing authenticated attackers to perform SQL injection through the guest_adult parameter.
Who is affected by CVE-2019-25749?
Authenticated users of Joomla J-CruisePortal 6.0.4 may be affected by CVE-2019-25749.
How can I fix CVE-2019-25749?
You can fix CVE-2019-25749 by updating Joomla J-CruisePortal to the latest version that addresses the SQL injection vulnerability.
Is there a workaround for CVE-2019-25749?
A potential workaround for CVE-2019-25749 is to restrict access to the cruises endpoint to only trusted users while awaiting an official patch.