# CVE-2019-25749: Cmsjunkie J-CruisePortal SQL injection in guest_adult parameter

Source: https://junglewise.ai/threats/cve-2019-25749-cmsjunkie-j-cruiseportal-sql-injection-in-guest-adult-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2019-25749 · Severity: high · CVSS 7.1 · Published 2026-06-19

Cmsjunkie J-CruisePortal, a cruise reservation extension for the Joomla content management system, contains a security flaw that allows logged-in users to interfere with the underlying database. By sending specially crafted requests, an attacker could steal sensitive information or modify database records. This could lead to unauthorized access to customer data or disruption of the reservation system.

Vendors: [Cmsjunkie](https://junglewise.ai/threats/vendors/cmsjunkie).

## Quick answers

**Is CVE-2019-25749 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25749 being exploited in the wild.

**How severe is CVE-2019-25749?** High severity, with a CVSS score of 7.1, published 19 June 2026.

**Which products and versions are affected?** Cmsjunkie J-CruisePortal 6.0.4.

**Is there a fix for CVE-2019-25749?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25749 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-25749?** Check whether you run Cmsjunkie J-CruisePortal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in the Cmsjunkie J-CruisePortal component (version 6.0.4) for Joomla. The flaw is located in the 'cruises' endpoint, specifically within the 'guest_adult' parameter handled during POST requests. An authenticated attacker can exploit this by injecting malicious SQL payloads into the parameter, leading to unauthorized data extraction or database record manipulation. The vulnerability stems from improper neutralization of special elements used in SQL commands (CWE-89). Proof-of-concept exploits demonstrate time-based blind SQL injection using the 'sleep' function.

## Affected products

- Cmsjunkie J-CruisePortal 6.0.4

## Timeline

- 2019-01-23: disclosed: Initial discovery and exploit publication by Ihsan Sencan
- 2026-06-19: advisory: CVE-2019-25749 published to NVD

## References

- [http://cmsjunkie.com/](http://cmsjunkie.com/)
- [https://www.cmsjunkie.com/joomla-cruise-reservation-portal](https://www.cmsjunkie.com/joomla-cruise-reservation-portal)
- [https://www.exploit-db.com/exploits/46233](https://www.exploit-db.com/exploits/46233)
- [https://www.vulncheck.com/advisories/joomla-j-cruiseportal-sql-injection-via-cruises](https://www.vulncheck.com/advisories/joomla-j-cruiseportal-sql-injection-via-cruises)