EUVD-2026-62498
GHSA-vm4v-78cf-23mr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible contact form, no auth required; intercepted emails fully disclose PII to attacker; no integrity or availability impact applies.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to an arbitrary address.
AnalysisAI
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attackers to redirect business contact emails to arbitrary recipients by supplying an attacker-controlled email address in the contact_id_offer or contact_id_event request parameters. The extension incorrectly trusts client-supplied input for recipient resolution rather than performing a server-side lookup against the referenced offer or event record. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target site has J-BusinessDirectory version 6.2.2 or earlier installed and active on a Joomla CMS instance, with at least one published offer or event listing whose contact form is publicly accessible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) correctly reflects unauthenticated network exploitation with no complexity barrier, and the C:H rating is defensible given that intercepted contact emails may carry PII and sensitive business inquiry data that is fully disclosed to the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a Joomla site running J-BusinessDirectory with a published offer or event listing, then submits a contact form POST request with the contact_id_offer or contact_id_event parameter set to an attacker-controlled email address. The site's mail server dispatches the inquiry - including the submitter's name, email, and message - to the attacker's inbox instead of the intended business owner, fully disclosing the contact data. … |
| Remediation | Upgrade J-BusinessDirectory to version 6.2.3 or later, which addresses the recipient resolution flaw by performing a server-side database lookup for the offer or event record rather than accepting the email destination from the client request. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Joomla instances running J-BusinessDirectory versions 1.0.0-6.2.2 and assess criticality; disable the extension immediately on non-critical systems and restrict the contact form to authenticated users only on essential instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote a
SQL injection in the J-BusinessDirectory extension for Joomla (by cmsjunkie.com) before version 6.2.3 lets remote attack
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attack
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version
Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exp
Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today