J-BusinessDirectory vulnerabilities

SQL injection vulnerability in Joomla extension J-BusinessDirectory (cmsjunkie.com) before version 6.2.3. In trips search, search keywords and ORDER BY were concatenated into SQL. Version 6.2.3 quotes keywords and allow-lists the sort clause.

The J-BusinessDirectory extension for Joomla before version 6.2.3 contains a vulnerability allowing arbitrary file upload/deletion via path traversal. The _path_type parameter can point to component site/admin trees, and the extension check is weak. CSRF token is also missing on upload/remove.

The Joomla extension J-BusinessDirectory before version 6.2.3 contains a DoS vulnerability in pagination parameter handling. Pagination values were not strictly typed. Array/non-numeric values (for example limitstart[]) could trigger PHP type errors in arithmetic, and limit was not validated before use in list queries.

The Joomla extension - cmsjunkie.com - J-BusinessDirectory before version 6.2.3 contains a reflected XSS / XML injection vulnerability. The companyName parameter from the request is written unescaped into an XML attribute, potentially allowing execution of malicious scripts in the victim's browser.

The Joomla extension J-BusinessDirectory versions below 6.2.3 contain an open mail relay. The recipient address is taken from the request (contact_id_offer / contact_id_event parameters) instead of the server-side offer/event record, allowing mail to be sent to an arbitrary address.

Joomla extension J-BusinessDirectory before version 6.2.3 contains a Cross-site request forgery (CSRF) vulnerability. Tokens are missing on many AJAX/state-changing tasks such as contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions. Frontend CSRF requires a registered/listing-owner session, while admin CSRF requires a backend admin session.

Joomla extension J-BusinessDirectory before version 6.2.3 contains an Insecure Direct Object Reference (IDOR) vulnerability in multiple frontend/API actions. This vulnerability allows direct object references without proper authorization.

Joomla extension J-BusinessDirectory before version 6.2.3 contains an unauthenticated listing ownership takeover vulnerability. Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. Version 6.2.3 binds the action to the authenticated user and only allows unowned listings.

The J-BusinessDirectory component version 4.9.7 for Joomla! contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the parameters option=com_jbusinessdirectory&task=categories.getCategories and inject UNION-based SQL statements to extract database information including schema names and sensitive data.