SEC.co
Emergency
HIGH 8.2

CVE-2019-25750: SQL Injection in Joomla J-MultipleHotelReservation 6.0.7

Joomla websites using the J-MultipleHotelReservation component (version 6.0.7) are vulnerable to SQL injection attacks. An attacker can send specially crafted requests to the hotel search function and inject malicious SQL commands that execute on the database. This doesn't require authentication, meaning anyone on the internet can attempt the attack. The primary risk is unauthorized access to sensitive data stored in the database, such as customer information, booking details, or other confidential records.

Source data · NVD / CISA · public domain

CVSS
3.1 · 8.2 HIGH · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses (CWE)
CWE-89
Affected products
0 configuration(s)
Published / Modified
2026-06-19 / 2026-06-22

NVD description (verbatim)

Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data.

4 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

CVE-2019-25750 is an unauthenticated SQL injection vulnerability in the J-MultipleHotelReservation Joomla component version 6.0.7. The vulnerability exists in the search-hotels endpoint, where the hotel_id parameter is not properly sanitized before being incorporated into SQL queries. An attacker can craft POST requests containing UNION SELECT statements to execute arbitrary SQL and extract schema information and database contents. The vulnerability stems from a classic failure to use parameterized queries or input validation (CWE-89: Improper Neutralization of Special Elements used in an SQL Command).

Business impact

Successful exploitation could result in disclosure of sensitive customer data, including personally identifiable information (PII) from booking systems, payment details, and contact information. For hotel businesses relying on this component, compromise of customer databases could trigger regulatory notification requirements under data protection laws (GDPR, CCPA, etc.), incur legal liability, and damage customer trust. The attack surface is broad since the vulnerability requires no authentication, making it accessible to anyone aware of the vulnerability.

Affected systems

Joomla websites running the J-MultipleHotelReservation component version 6.0.7 are directly affected. Organizations using older or outdated Joomla installations with this hotel reservation extension are at risk. The vulnerability does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting exploitation in the wild may be limited, but the ease of exploitation (low attack complexity, no special conditions) means risk remains substantial.

Exploitability

This vulnerability has a low attack complexity and requires no user interaction or authentication, making it relatively straightforward to exploit. An attacker needs only network access and knowledge of the affected endpoint URL. Standard SQL injection techniques—particularly UNION SELECT statements—can be used to extract data. The lack of KEV designation does not diminish the practical exploitability; rather, it may indicate the vulnerability has not yet been widely weaponized or is not commonly used in ransomware campaigns.

Remediation

Organizations should immediately upgrade the J-MultipleHotelReservation component to a patched version that addresses this SQL injection vulnerability. Verify the latest available version from the official Joomla extensions repository or the component vendor. If an immediate patch is unavailable, consider temporarily disabling the hotel reservation functionality or restricting access to the search-hotels endpoint via web application firewall rules. Additionally, review database access logs and check for signs of exploitation dating back to when the vulnerability was introduced.

Patch guidance

Contact the J-MultipleHotelReservation component maintainers or check the official Joomla extensions marketplace for a patched version. Verify against the vendor advisory to confirm the specific patched version that addresses CVE-2019-25750. Apply the patch during a maintenance window after backing up your Joomla installation. Test the patched component in a staging environment to ensure compatibility with your Joomla version and other extensions before deploying to production.

Detection guidance

Monitor access logs for suspicious POST requests to the search-hotels endpoint that contain unusual characters, SQL keywords (SELECT, UNION, WHERE), or encoded payloads. Look for HTTP requests with parameters like hotel_id containing single quotes, comments (-- or /*), or UNION clauses. Web application firewalls (WAF) can be configured to block common SQL injection patterns. Database query logs may show unexpected queries or schema introspection attempts that indicate exploitation attempts.

Why prioritize this

This vulnerability merits high priority due to its CVSS 3.1 score of 8.2 (HIGH severity), unauthenticated access requirement, and direct impact on data confidentiality. The attack vector is network-based with low complexity, making it accessible to a broad threat landscape. While not yet in the KEV catalog, the ease of exploitation and potential for customer data theft create significant business and legal risk for affected organizations.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: (1) Network attack vector (AV:N)—anyone on the internet can attempt exploitation; (2) Low attack complexity (AC:L)—no special conditions or tools required; (3) No privileges needed (PR:N)—unauthenticated access is possible; (4) No user interaction (UI:N)—automated attack is feasible; (5) High confidentiality impact (C:H)—full database disclosure is possible; and (6) Low integrity impact (I:L) and no availability impact (A:N). The absence of integrity or availability impact prevents a critical rating, but data breach risk justifies the HIGH severity classification.

Frequently asked questions

Can this vulnerability be exploited if we've disabled public access to hotel search?

Partial risk reduction is possible, but network segmentation controls must be thoroughly tested. The vulnerability exists in the code itself, so any internet-facing instance of the endpoint remains exploitable unless the component is patched or completely removed. Verify your WAF rules are correctly blocking malicious payloads.

Is there evidence this vulnerability is being exploited in the wild?

CVE-2019-25750 does not currently appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation by threat actors may be limited at this time. However, the public disclosure and straightforward nature of SQL injection make it a target for opportunistic attackers and automated scanning tools.

What data might an attacker extract?

An attacker can extract any data accessible to the Joomla database user account, including customer names, email addresses, phone numbers, booking details, payment information if stored in the same database, and administrative account credentials. The scope depends on database schema and what sensitive data the hotel reservation system stores.

Do we need to check for past exploitation?

Yes. Review database access logs, web server logs, and application logs for suspicious activity dating back to when version 6.0.7 was deployed. Check for queries containing UNION SELECT, unexpected schema queries, or error messages indicative of SQL injection attempts. A forensic review may be necessary if you suspect successful exploitation occurred.

This analysis is based on published vulnerability information current as of the modification date (2026-06-22). Patch version numbers and specific remediation steps should be verified against the official vendor advisory and your vendor's security communications. This is not a guarantee of exploitability in your environment; actual risk depends on your specific Joomla configuration, network controls, and data sensitivity. No exploit code or proof-of-concept steps are provided. Organizations should consult with their security team and follow their standard change management procedures before applying patches. Source: NVD (public-domain), retrieved 2026-07-27. Analysis generated by SEC.co (claude-haiku-4-5).

Weaknesses (CWE)

CWE-89

Related vulnerabilities