PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-25749 Cmsjunkie CVE debrief

CVE-2019-25749 is an SQL injection vulnerability in Joomla J-CruisePortal 6.0.4. Authenticated attackers can execute arbitrary SQL queries by injecting malicious code through the guest_adult parameter in POST requests to the cruises endpoint. This vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. The affected product and scope are Joomla J-CruisePortal 6.0.4. Defenders should assess their exposure and prioritize patching. The defensive priority is to limit exposure to potential SQL injection attacks.

Vendor
Cmsjunkie
Product
J-CruisePortal
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-08-19
Advisory published
2026-06-19
Advisory updated
2026-08-19

Who should care

Defenders responsible for Joomla J-CruisePortal installations, particularly those using version 6.0.4, should assess their exposure and prioritize patching to prevent potential SQL injection attacks. Security teams and administrators of Joomla-based systems should review and update their systems accordingly.

Technical summary

The vulnerability exists in Joomla J-CruisePortal 6.0.4, where an authenticated attacker can inject malicious SQL code through the guest_adult parameter in POST requests to the cruises endpoint. This allows for the execution of arbitrary SQL queries, potentially leading to sensitive database information extraction or database record manipulation. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Limit exposure to potential SQL injection attacks by prioritizing patching of Joomla J-CruisePortal 6.0.4 and ensuring secure coding practices.

Recommended defensive actions

  • Inventory Joomla J-CruisePortal installations to identify instances that may be vulnerable.
  • Review and apply official patches or updates for Joomla J-CruisePortal 6.0.4.
  • Implement compensating controls, such as web application firewalls, to detect and prevent SQL injection attacks.
  • Monitor systems for suspicious activity, particularly POST requests to the cruises endpoint.
  • Track exceptions and anomalies in database queries to identify potential attacks.

Evidence notes

The primary evidence for this vulnerability comes from the CVE record and NVD detail pages. The CVE-2019-25749 record indicates an SQL injection vulnerability in Joomla J-CruisePortal 6.0.4. The NVD detail page provides additional information, including the CVSS vector and references to exploit databases and vendor advisories. Defenders should verify the affected product and version from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-25749 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-25749

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-25749 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-25749

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.