CVE-2019-25750: Joomla J-MultipleHotelReservation 6.0.7 SQL Injection
Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotelid parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla Component J-MultipleHotelReservationfrom your environment.Uninstall the J-MultipleHotelReservation component from any affected Joomla instances or remove the component's 'search-hotels' functionality if it is not required.
- Configuration
Disable the J-MultipleHotelReservation component in the Joomla administrator interface (set the component to disabled) until a vendor fix is available.
Joomla Component J-MultipleHotelReservation enabled = false - Compensating control
Use a web application firewall, application-layer filtering, or network ACLs to block or restrict access to the 'search-hotels' endpoint and to the hotel_id parameter; apply input validation and SQL injection protections to requests that reach the application.
- Operational
Audit application and database logs for suspicious POST requests to the search-hotels endpoint and signs of data exfiltration. Rotate database credentials and any potentially exposed credentials if evidence of compromise is found.
Event History
Frequently Asked Questions
What is the vulnerability ID for the Joomla J-MultipleHotelReservation SQL Injection?
The vulnerability ID is CVE-2019-25750.
What is the severity level of CVE-2019-25750?
CVE-2019-25750 has a severity level of 8.8, classified as high.
What type of vulnerability is represented by CVE-2019-25750?
CVE-2019-25750 is an SQL Injection vulnerability.
How can I fix CVE-2019-25750?
To fix CVE-2019-25750, update the Joomla Component J-MultipleHotelReservation to the latest version that addresses this SQL injection issue.
What impact does CVE-2019-25750 have on affected systems?
CVE-2019-25750 allows unauthenticated attackers to execute arbitrary SQL queries, posing a risk of data exposure.