CVE-2019-25752
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The J-BusinessDirectory component version 4.9.7 for Joomla! contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the parameters option=com_jbusinessdirectory&task=categories.getCategories and inject UNION-based SQL statements to extract database information including schema names and sensitive data.
Risk Assessment
This vulnerability poses a serious risk to organizations, allowing attackers to access sensitive data in the database. It may lead to data confidentiality loss and violations of data protection regulations.
Recommendation
It is recommended to update the J-BusinessDirectory component to the latest version to mitigate this vulnerability. Additionally, implementing security measures such as input filtering and validation is advisable.
Original NVD description (English source)
Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=com_jbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to extract database information including schema names and sensitive data.