Executive brief
Cmsjunkie J-CruisePortal, a cruise reservation extension for the Joomla content management system, contains a security flaw that allows logged-in users to interfere with the underlying database. By sending specially crafted requests, an attacker could steal sensitive information or modify database records. This could lead to unauthorized access to customer data or disruption of the reservation system.
Technical details
An SQL injection vulnerability exists in the Cmsjunkie J-CruisePortal component (version 6.0.4) for Joomla. The flaw is located in the 'cruises' endpoint, specifically within the 'guest_adult' parameter handled during POST requests. An authenticated attacker can exploit this by injecting malicious SQL payloads into the parameter, leading to unauthorized data extraction or database record manipulation. The vulnerability stems from improper neutralization of special elements used in SQL commands (CWE-89). Proof-of-concept exploits demonstrate time-based blind SQL injection using the 'sleep' function.
Affected products
- Cmsjunkie J-CruisePortal 6.0.4
Timeline
- 2019-01-23: disclosed: Initial discovery and exploit publication by Ihsan Sencan
- 2026-06-19: advisory: CVE-2019-25749 published to NVD