J-BusinessDirectory EUVD-2026-62490

Exploitation requires that the J-BusinessDirectory extension (version < 6.2.3) is installed on a reachable Joomla site and that the 'trips' search functionality is exposed to the attacker - the injectable inputs are the search keyword and the ORDER BY / sort parameter of that search. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, so this is remote unauthenticated exploitation against default installations that expose trips search. Limiting factors: the site must actually deploy this specific commercial extension at a vulnerable version and surface the trips search feature; deployments that have removed, disabled, or gated the search behind access controls, or already run 6.2.3+, are not exploitable.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector aligns fully with the description: AV:N/AC:L/PR:N/UI:N means an unauthenticated remote attacker can reach the vulnerable search endpoint over the network with no user interaction and low complexity, and VC:H/VI:H/VA:H reflects that SQL injection typically grants read and write access to the backing database. EPSS was not supplied and the CVE is not in CISA KEV, and no POC reference is present, so exploitation appears to be a demonstrated-capability risk rather than confirmed active exploitation - the signals are consistent (no conflict), just incomplete on the exploitation-probability side. Because the flaw sits in a public-facing search feature that requires no authentication, any operator running J-BusinessDirectory below 6.2.3 should treat patching as urgent regardless of organization size. The primary uncertainty is the real-world deployment footprint of this specific paid Joomla extension, which tempers aggregate risk but not per-instance severity.

An unauthenticated attacker browses to the site's J-BusinessDirectory trips search, then submits a crafted keyword or manipulated sort parameter containing SQL syntax (e.g., a UNION-based payload or a boolean/time-based ORDER BY injection). The application concatenates the input into its query, letting the attacker enumerate and exfiltrate database contents such as user credentials, or alter records. No public POC is referenced, but the injection is straightforward given AV:N/AC:L/PR:N.