Description
Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cmsjunkie | MultipleHotelReservation | 6.0.7 | — |
References
- ExploitDB-46232 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Joomla J-MultipleHotelReservation 6.0.7 SQL Injection third-party-advisory