J Businessdirectory Extension For Joomla
Monthly
Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com) allows attackers to trick authenticated users into performing unauthorized state-changing actions across a broad set of unprotected endpoints. Missing CSRF tokens span both frontend operations - contact forms, cart, bookmarks, file uploads, messages, and AI text generation - and sensitive administrator actions including demo-data wipe, app install, cache archiving, and mobile push notification dispatch. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.6 reflects mandatory victim interaction and the requirement for an authenticated session.
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attackers to redirect business contact emails to arbitrary recipients by supplying an attacker-controlled email address in the contact_id_offer or contact_id_event request parameters. The extension incorrectly trusts client-supplied input for recipient resolution rather than performing a server-side lookup against the referenced offer or event record. No public exploit has been identified and EPSS is at the 5th percentile, but the zero-authentication requirement and trivial exploitation path make opportunistic abuse of the site's mail infrastructure realistic.
Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exposes site users to client-side script execution via a crafted link. The companyName HTTP request parameter is written directly into an XML attribute without output encoding, allowing attacker-controlled markup to be reflected in server responses. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated attack vector makes it a realistic phishing-leveraged threat against any publicly accessible site running the affected extension.
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attackers to access and modify business directory records belonging to other users across multiple frontend and API endpoints. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required, meaning any internet-connected user can exploit the flaw against a default installation. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote attackers to crash directory listing pages by supplying array or non-numeric values to pagination parameters such as limitstart[]. PHP arithmetic performed on these malformed inputs triggers fatal type errors, rendering the affected extension inoperable. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
SQL injection in the J-BusinessDirectory extension for Joomla (by cmsjunkie.com) before version 6.2.3 lets remote attackers inject arbitrary SQL through the trips search feature, where user-supplied search keywords and the ORDER BY sort clause are concatenated directly into a query. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, score 9.3) indicates unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but SQL injection in a public search endpoint is trivially weaponizable.
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote attackers write or remove files anywhere in the component's site and administrator directory trees, enabling web shell deployment and full site compromise. The flaw combines a client-controlled storage root (_path_type), absent path-containment checks, a weak file-extension filter, and a missing CSRF token on the upload/remove handlers. Rated CVSS 4.0 10.0 (critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version 6.2.3 permits any remote unauthenticated attacker to claim ownership of business directory listings - including listings already owned by legitimate users - by supplying attacker-controlled company and user IDs in HTTP requests. The vulnerability stems from improper access control (CWE-284): the ownership-assignment action is not bound to an authenticated session nor restricted to unowned listings. Version 6.2.3 corrects both deficiencies. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com) allows attackers to trick authenticated users into performing unauthorized state-changing actions across a broad set of unprotected endpoints. Missing CSRF tokens span both frontend operations - contact forms, cart, bookmarks, file uploads, messages, and AI text generation - and sensitive administrator actions including demo-data wipe, app install, cache archiving, and mobile push notification dispatch. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.6 reflects mandatory victim interaction and the requirement for an authenticated session.
Open mail relay in the J-BusinessDirectory Joomla extension (versions 1.0.0-6.2.2) allows unauthenticated remote attackers to redirect business contact emails to arbitrary recipients by supplying an attacker-controlled email address in the contact_id_offer or contact_id_event request parameters. The extension incorrectly trusts client-supplied input for recipient resolution rather than performing a server-side lookup against the referenced offer or event record. No public exploit has been identified and EPSS is at the 5th percentile, but the zero-authentication requirement and trivial exploitation path make opportunistic abuse of the site's mail infrastructure realistic.
Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exposes site users to client-side script execution via a crafted link. The companyName HTTP request parameter is written directly into an XML attribute without output encoding, allowing attacker-controlled markup to be reflected in server responses. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated attack vector makes it a realistic phishing-leveraged threat against any publicly accessible site running the affected extension.
Insecure Direct Object Reference (IDOR) in J-BusinessDirectory versions below 6.2.3 allows unauthenticated remote attackers to access and modify business directory records belonging to other users across multiple frontend and API endpoints. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication is required, meaning any internet-connected user can exploit the flaw against a default installation. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote attackers to crash directory listing pages by supplying array or non-numeric values to pagination parameters such as limitstart[]. PHP arithmetic performed on these malformed inputs triggers fatal type errors, rendering the affected extension inoperable. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
SQL injection in the J-BusinessDirectory extension for Joomla (by cmsjunkie.com) before version 6.2.3 lets remote attackers inject arbitrary SQL through the trips search feature, where user-supplied search keywords and the ORDER BY sort clause are concatenated directly into a query. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, score 9.3) indicates unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but SQL injection in a public search endpoint is trivially weaponizable.
Arbitrary file upload and deletion in the J-BusinessDirectory extension for Joomla (versions before 6.2.3) lets remote attackers write or remove files anywhere in the component's site and administrator directory trees, enabling web shell deployment and full site compromise. The flaw combines a client-controlled storage root (_path_type), absent path-containment checks, a weak file-extension filter, and a missing CSRF token on the upload/remove handlers. Rated CVSS 4.0 10.0 (critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated listing ownership takeover in J-BusinessDirectory (a Joomla extension by cmsjunkie.com) prior to version 6.2.3 permits any remote unauthenticated attacker to claim ownership of business directory listings - including listings already owned by legitimate users - by supplying attacker-controlled company and user IDs in HTTP requests. The vulnerability stems from improper access control (CWE-284): the ownership-assignment action is not bound to an authenticated session nor restricted to unowned listings. Version 6.2.3 corrects both deficiencies. No public exploit code has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.