J-BusinessDirectory EUVD-2026-62491

No special conditions are required beyond the target site having J-BusinessDirectory below version 6.2.3 installed with the extension's directory listing pages publicly accessible over HTTP. The specific trigger is supplying an array-formatted or non-numeric value for the limitstart or limit pagination parameters on any endpoint handled by the extension. Exploitation is limited to Joomla installations running this specific extension; sites that restrict directory listing pages via Joomla ACL controls requiring authentication are not exploitable by unauthenticated attackers. No special PHP configuration, non-default Joomla settings, or privileged access is required.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the unauthenticated, zero-complexity nature of the attack and the high availability impact on the vulnerable system. Real-world risk is substantially constrained by the limited deployment footprint of this niche Joomla extension - organizations without J-BusinessDirectory installed are entirely unaffected. No EPSS score was supplied in the source intelligence, so exploitation probability cannot be numerically quantified. The input CVSS 4.0 vector includes SI:L (subsequent system integrity: low), which is mildly inconsistent with the description that describes only availability impact; the source of that integrity signal is not confirmed and may reflect indirect effects on Joomla caching or state. There is no KEV listing and no known POC code, so while the attack surface is trivially exploitable in theory, there is no confirmed evidence of active in-the-wild exploitation.

An unauthenticated attacker sends an HTTP GET request to a public Joomla site running J-BusinessDirectory, supplying a malformed pagination parameter such as ?limitstart[]=0&limitstart[]=1. PHP arithmetic on the array value raises a fatal type error in the extension's pagination logic, crashing the directory listing endpoint and returning a 500 error to all users until the process recovers. No exploit code has been publicly identified, but the attack requires only a standard HTTP client and knowledge of the affected parameter name.