PatchSiren cyber security CVE debrief
CVE-2019-25749 Cmsjunkie CVE debrief
CVE-2019-25749 is an SQL injection vulnerability in Joomla J-CruisePortal 6.0.4. Authenticated attackers can execute arbitrary SQL queries by injecting malicious code through the guest_adult parameter in POST requests to the cruises endpoint. This vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. The affected product and scope are Joomla J-CruisePortal 6.0.4. Defenders should assess their exposure and prioritize patching. The defensive priority is to limit exposure to potential SQL injection attacks.
- Vendor
- Cmsjunkie
- Product
- J-CruisePortal
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-19
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-19
- Advisory updated
- 2026-06-22
Who should care
Defenders responsible for Joomla J-CruisePortal installations, particularly those using version 6.0.4, should assess their exposure and prioritize patching to prevent potential SQL injection attacks. Security teams and administrators of Joomla-based systems should review and update their systems accordingly.
Technical summary
The vulnerability exists in Joomla J-CruisePortal 6.0.4, where an authenticated attacker can inject malicious SQL code through the guest_adult parameter in POST requests to the cruises endpoint. This allows for the execution of arbitrary SQL queries, potentially leading to sensitive database information extraction or database record manipulation. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
Defensive priority
Limit exposure to potential SQL injection attacks by prioritizing patching of Joomla J-CruisePortal 6.0.4 and ensuring secure coding practices.
Recommended defensive actions
- Inventory Joomla J-CruisePortal installations to identify instances that may be vulnerable.
- Review and apply official patches or updates for Joomla J-CruisePortal 6.0.4.
- Implement compensating controls, such as web application firewalls, to detect and prevent SQL injection attacks.
- Monitor systems for suspicious activity, particularly POST requests to the cruises endpoint.
- Track exceptions and anomalies in database queries to identify potential attacks.
Evidence notes
The primary evidence for this vulnerability comes from the CVE record and NVD detail pages. The CVE-2019-25749 record indicates an SQL injection vulnerability in Joomla J-CruisePortal 6.0.4. The NVD detail page provides additional information, including the CVSS vector and references to exploit databases and vendor advisories. Defenders should verify the affected product and version from official sources.
Official resources
This article is AI-assisted and based on the supplied source corpus.