The vulnerability is an SQL injection flaw that allows attackers to inject malicious SQL code into the rooms parameter of the search‑hotels endpoint. Because the input is not properly sanitized before being included in an SQL query, an unauthenticated attacker can send a crafted POST request to execute arbitrary SQL statements. The result is the extraction of sensitive database information, such as database version details, which constitutes a breach of confidentiality and gives the attacker a foothold for further database‑level attacks.

The target is the Joomla JHotelReservation extension, version 6.0.7, distributed by Cmsjunkie and deployed as a booking and reservation component within Joomla sites.

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation yet. Attacks can be launched remotely by issuing unauthenticated HTTP POST requests to the search‑hotels endpoint, showing that the flaw is exploitable by anyone who can reach the website. Successful exploitation would enable unauthorized execution of SQL code and data theft, without additional conditions for escalation, but the compromised data could serve as a stepping stone for more advanced attacks.