CVE-2019-25750
HIGHJoomla J-MultipleHotelReservation 6.0.7 SQL Injection
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25750. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary This is a functional SQL injection exploit for Joomla! Component J-MultipleHotelReservation 6.0.7. The exploit demonstrates a UNION-based SQL injection via the 'rooms' parameter in a POST request, allowing an attacker to extract sensitive data from the database.
Description
Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data.
Exploits (1)
This is a functional SQL injection exploit for Joomla! Component J-MultipleHotelReservation 6.0.7. The exploit demonstrates a UNION-based SQL injection via the 'rooms' parameter in a POST request, allowing an attacker to extract sensitive data from the database.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N