CVE-2019-25750: Joomla J-MultipleHotelReservation SQLi

CVE-2019-25750 Overview

CVE-2019-25750 is a SQL injection vulnerability in the Joomla component J-MultipleHotelReservation version 6.0.7. The flaw allows unauthenticated attackers to inject arbitrary SQL queries through the hotel_id parameter on the search-hotels endpoint. Attackers can craft POST requests containing UNION SELECT statements to extract sensitive database content, including table names and column values. The vulnerability is tracked under CWE-89 and is exploitable remotely without authentication or user interaction. A public proof-of-concept is available on Exploit-DB, increasing the likelihood of opportunistic exploitation against unpatched Joomla installations.

Critical Impact
Unauthenticated remote attackers can extract sensitive database records — including credentials and reservation data — from affected Joomla sites by injecting SQL through the hotel_id parameter.

Affected Products

Joomla Component J-MultipleHotelReservation 6.0.7
Distributed via CMS Junkie and the Joomla Extensions Directory
Any Joomla site running the vulnerable extension version on the public-facing search-hotels endpoint

Discovery Timeline

2026-06-19 - CVE-2019-25750 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25750

Vulnerability Analysis

The vulnerability resides in the search-hotels handler of the J-MultipleHotelReservation Joomla extension. The component accepts a hotel_id parameter from POST requests and concatenates the value directly into a SQL query without parameterization or input sanitization. An attacker can submit a crafted payload that terminates the original query context and appends a UNION SELECT statement to retrieve arbitrary data from the underlying MySQL database.

Because the endpoint is reachable without authentication, exploitation requires no prior account or session. Attackers can iterate column counts, enumerate information_schema tables, and exfiltrate data such as Joomla user credentials, session tokens, and customer reservation records. The flaw is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Root Cause

The root cause is the absence of prepared statements or parameter binding in the database access logic for hotel_id. The extension trusts client-supplied input and embeds it directly into the query string. No type validation enforces an integer constraint on the parameter, which would otherwise neutralize string-based injection payloads.

Attack Vector

The attack vector is network-based over HTTP/HTTPS. An attacker sends a POST request to the search-hotels endpoint of a vulnerable Joomla site with a malicious hotel_id value containing SQL syntax. The injected UNION SELECT payload returns attacker-chosen columns in the response, enabling data extraction. The technique is documented in the public exploit at Exploit-DB #46232 and the VulnCheck Advisory on Joomla SQL Injection.

No verified code examples are included here. Refer to the linked advisories for the full proof-of-concept payload structure.

Detection Methods for CVE-2019-25750

Indicators of Compromise

POST requests to the search-hotels endpoint containing SQL keywords such as UNION, SELECT, information_schema, or -- in the hotel_id parameter.
Web server access logs showing unusually long hotel_id values, encoded quote characters (%27), or comment sequences.
Database error messages or stack traces returned in HTTP responses originating from the J-MultipleHotelReservation extension.
Unexpected outbound queries against information_schema.tables or #__users table reads outside normal application flow.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL syntax in the hotel_id POST parameter on Joomla endpoints.
Inspect Joomla access logs for sequential probing patterns characteristic of UNION-based SQL injection enumeration.
Enable MySQL general query logging temporarily on suspect hosts to identify queries containing UNION SELECT originating from the extension.

Monitoring Recommendations

Alert on HTTP 500 responses or database error strings returned by the search-hotels endpoint.
Track outbound data volume from the database server to the Joomla web tier for anomalous spikes consistent with bulk data extraction.
Correlate authentication failures and successful logins following SQL injection attempts to detect credential reuse after extraction.

How to Mitigate CVE-2019-25750

Immediate Actions Required

Identify all Joomla installations running J-MultipleHotelReservation 6.0.7 and restrict public access to the search-hotels endpoint until remediation is complete.
Deploy WAF signatures that block SQL metacharacters and UNION SELECT patterns in the hotel_id parameter.
Rotate Joomla administrator credentials and database service account passwords if exploitation is suspected.
Audit the Joomla #__users table and reservation tables for unauthorized read access using database audit logs.

Patch Information

No official vendor patch is referenced in the available advisory data. Consult the CMS Junkie Resource Hub and the Joomla Extension Listing for the latest version of the extension. If no fixed release is available, remove the extension from production sites.

Workarounds

Uninstall or disable the J-MultipleHotelReservation extension until a patched version is released.
Place the Joomla site behind a WAF with virtual patching rules targeting SQL injection on the affected endpoint.
Enforce strict integer validation on the hotel_id parameter at a reverse proxy or WAF layer to reject non-numeric input.
Apply least-privilege database permissions to the Joomla MySQL user, removing access to information_schema and unrelated tables where feasible.

bash

# Example WAF rule (ModSecurity) to block SQL injection on hotel_id
SecRule ARGS:hotel_id "@rx (?i)(union(\s|\+)+select|information_schema|--|/\*)" \
    "id:1925750,phase:2,deny,status:403,log,msg:'CVE-2019-25750 SQLi attempt on hotel_id'"