J-BusinessDirectory CVE-2026-75952

Frontend CSRF exploitation requires the victim to hold an active, registered user or listing-owner session on the affected Joomla site; endpoints vulnerable in this context include contact/quote forms, cart operations, bookmarks, file uploads, message submission, and AI text generation. Admin CSRF exploitation requires the victim to hold an active Joomla backend administrator session; endpoints vulnerable in this context include app installation, demo-data wipe, cache and statistics archiving, payment notification dispatch, and mobile push triggers. In both cases, the victim must be socially engineered into visiting an attacker-controlled web page or clicking a crafted link while authenticated - passive network observation is insufficient. Exploitation is bounded to integrity impacts only, with no confidentiality or availability exposure. The mandatory authenticated-victim prerequisite significantly restricts opportunistic or automated exploitation.

Real-world risk is moderate and substantially constrained by multiple limiting factors. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N) encodes two critical mitigants: the victim must actively interact with attacker-controlled content (UI:A) while holding a high-privilege session (PR:H for the most severe admin variants). No EPSS data was provided, but the absence from CISA KEV and the niche deployment footprint of the product both suggest a low probability of opportunistic exploitation at scale - even a mid-sized municipal IT team in sopot running a local business directory would face limited exposure provided admin sessions are protected by IP allowlists or multi-factor authentication. The most damaging admin-side actions - demo-data wipe and rogue app installation - require a backend administrator to follow a malicious link while authenticated, making targeted social engineering the realistic threat model rather than mass exploitation. The impact is limited to low integrity changes with no confidentiality or availability exposure (VI:L, VC:N, VA:N), though demo-data destruction and unauthorized payment notifications represent genuine operational disruptions disproportionate to the raw CVSS score.

An attacker targeting a Joomla site running J-BusinessDirectory before 6.2.3 sends a spear-phishing email to a backend administrator, including a link to a malicious page hosting a hidden auto-submitting HTML form targeting the demo-data wipe or app-install endpoint. When the administrator opens the link while their backend session is active, the browser transparently submits the cross-origin POST request bearing the victim's session cookie, and the server - lacking token validation - executes the action as legitimate. No public proof-of-concept code has been identified at time of analysis, and exploitation requires deliberate social engineering.