CVE-2019-25748
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Joomla JHotelReservation version 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rooms parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL payloads in the rooms parameter to extract sensitive database information including version details.
Risk Assessment
This vulnerability poses a serious risk to data security, allowing attackers to access sensitive information in the database, which could lead to further attacks or data breaches.
Recommendation
It is recommended to update Joomla JHotelReservation to the latest version to mitigate this vulnerability and implement appropriate security measures such as input filtering and validation.
Original NVD description (English source)
Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rooms parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL payloads in the rooms parameter to extract sensitive database information including version details.