# CVE-2019-25748: Cmsjunkie JHotelReservation SQL injection in search-hotels

Source: https://junglewise.ai/threats/cve-2019-25748-cmsjunkie-jhotelreservation-sql-injection-in-search-hotels  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2019-25748 · Severity: high · CVSS 8.2 · Published 2026-06-19

Cmsjunkie JHotelReservation is a booking and management extension for Joomla websites used by hotels and resorts to handle online reservations. A security vulnerability in version 6.0.7 allows unauthorized individuals to bypass security controls and access the underlying database. This could lead to the theft of sensitive customer information, reservation details, and server configuration data, potentially damaging the business's reputation and operational security.

Vendors: [Cmsjunkie](https://junglewise.ai/threats/vendors/cmsjunkie).

## Quick answers

**Is CVE-2019-25748 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25748 being exploited in the wild.

**How severe is CVE-2019-25748?** High severity, with a CVSS score of 8.2, published 19 June 2026.

**Which products and versions are affected?** Cmsjunkie JHotelReservation 6.0.7.

**Is there a fix for CVE-2019-25748?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25748 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-25748?** Check whether you run Cmsjunkie JHotelReservation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in the JHotelReservation component (version 6.0.7) for Joomla. The flaw is located in the 'search-hotels' endpoint, where the 'rooms' parameter in a POST request is not properly sanitized before being used in a database query. An unauthenticated remote attacker can exploit this by sending a crafted POST request containing SQL payloads (such as UNION SELECT statements). Successful exploitation allows the attacker to execute arbitrary SQL commands, enabling the extraction of sensitive data from the database, including version information and potentially user credentials or customer records. A public exploit has been documented in Exploit-DB.

## Affected products

- Cmsjunkie JHotelReservation 6.0.7

## Timeline

- 2019-01-23: disclosed: Vulnerability discovered and exploit published by Ihsan Sencan
- 2026-06-19: advisory: CVE published by VulnCheck and NVD

## References

- [http://cmsjunkie.com/](http://cmsjunkie.com/)
- [https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jhotelreservation/](https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jhotelreservation/)
- [https://www.exploit-db.com/exploits/46234](https://www.exploit-db.com/exploits/46234)
- [https://www.vulncheck.com/advisories/joomla-jhotelreservation-sql-injection-via-search-hotels](https://www.vulncheck.com/advisories/joomla-jhotelreservation-sql-injection-via-search-hotels)