CVE-2019-25749: Joomla J-CruisePortal SQLi Vulnerability

CVE-2019-25749 Overview

CVE-2019-25749 is an SQL injection vulnerability in Joomla J-CruisePortal 6.0.4, a cruise reservation extension published by CMS Junkie. The flaw resides in the cruises endpoint, where the guest_adult parameter is concatenated into a SQL query without proper sanitization. Authenticated attackers can submit crafted POST requests to inject arbitrary SQL statements, allowing them to extract sensitive database contents or manipulate stored records. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can read or modify backend database contents through the guest_adult parameter, exposing booking data, customer information, and credentials stored by the Joomla extension.

Affected Products

Joomla J-CruisePortal extension version 6.0.4
CMS Junkie Joomla Cruise Reservation Portal component
Joomla sites that expose the cruises endpoint of this extension

Discovery Timeline

2026-06-19 - CVE-2019-25749 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25749

Vulnerability Analysis

The vulnerability is an SQL injection issue in the J-CruisePortal 6.0.4 component for Joomla. The application accepts a guest_adult parameter through POST requests directed at the cruises endpoint. The parameter value is incorporated into a backend SQL query without parameterization or input validation.

An authenticated user can place SQL syntax inside guest_adult to alter the query's logic. Successful exploitation lets the attacker enumerate database schema, exfiltrate records, or modify booking and customer tables. Because the injection is reachable over the network and requires only low-privilege authentication, exploitation can be automated with standard tools such as sqlmap.

A public proof-of-concept is published as Exploit-DB #46233, and additional technical context is available in the VulnCheck Joomla SQL Injection Advisory.

Root Cause

The root cause is direct string concatenation of user-controlled input into a SQL statement. The guest_adult parameter is treated as a trusted numeric value but is never cast, validated, or bound as a prepared statement parameter. This violates secure query construction practices and produces a classic first-order SQL injection sink.

Attack Vector

The attacker authenticates to the Joomla site, then issues a POST request to the cruises endpoint containing a malicious payload in the guest_adult field. The injected SQL is executed against the Joomla database with the privileges of the application's database user. No user interaction is required beyond the attacker-driven HTTP request.

No verified exploit code is reproduced here. Refer to the Exploit-DB advisory for the public payload structure and request format.

Detection Methods for CVE-2019-25749

Indicators of Compromise

POST requests to the cruises endpoint where the guest_adult parameter contains SQL metacharacters such as ', --, UNION, SELECT, or SLEEP(
Unusual SELECT, UPDATE, or INFORMATION_SCHEMA queries originating from the Joomla database user in MySQL or MariaDB query logs
Spikes in 500-series HTTP errors or unusually long response times from the cruises endpoint, indicating blind or time-based injection probing
Repeated authenticated requests to cruises from a single account or IP outside normal booking patterns

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the guest_adult POST parameter for non-numeric content and known SQL injection signatures
Enable MySQL or MariaDB general query logging during incident response to capture injected statements issued by the Joomla database account
Correlate Joomla authentication logs with cruises endpoint access to identify low-privilege accounts probing the parameter
Run authenticated sqlmap scans against staging environments to validate detection coverage before production rollout

Monitoring Recommendations

Forward Apache, Nginx, and Joomla logs to a centralized SIEM and alert on SQL injection patterns targeting guest_adult
Monitor outbound traffic from the web server for unexpected database dumps or large response payloads from cruises
Track new Joomla user registrations followed by immediate access to cruise reservation pages, which can indicate exploitation by throwaway accounts

How to Mitigate CVE-2019-25749

Immediate Actions Required

Audit installed Joomla extensions and confirm whether J-CruisePortal 6.0.4 is present on any site
Restrict access to the cruises endpoint to trusted authenticated roles until a vendor fix is applied
Rotate Joomla database credentials and review user tables for unauthorized modifications or new administrator accounts
Apply WAF virtual patching rules that reject non-numeric or signature-matching values in the guest_adult parameter

Patch Information

No vendor patch is referenced in the available advisories for J-CruisePortal 6.0.4. Administrators should contact CMS Junkie to confirm the availability of a fixed release of the Joomla Cruise Reservation Portal. If no fix is available, consider replacing the extension or disabling the affected functionality.

Workarounds

Disable or unpublish the J-CruisePortal component until a patched version is confirmed
Configure the Joomla database account used by the extension with the minimum required privileges and revoke FILE, DROP, and cross-database permissions
Deploy a WAF rule that enforces an integer-only constraint on guest_adult at the perimeter
Place the cruises endpoint behind additional authentication or IP allow-listing where business workflow permits

bash

# Example ModSecurity rule to enforce integer-only guest_adult values
SecRule ARGS:guest_adult "!@rx ^[0-9]{1,3}$" \
    "id:1002749,phase:2,deny,status:403,log,\
    msg:'CVE-2019-25749 J-CruisePortal guest_adult SQLi attempt'"