External risk intelligence

Joomla J-BusinessDirectory SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75954

The vulnerability exists in a Joomla extension designed for business directories, which typically function as public-facing web applications. These components are intended to be accessible to internet users for searching and directory interaction, making the affected search functionality a standard public-facing web endpoint.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security vulnerability within a Joomla extension that could allow an attacker to manipulate database queries. This type of vulnerability, known as SQL injection, can potentially lead to unauthorized access or modification of sensitive information stored within the application. The main concern at this time is confirming if this extension is in use and, if so, determining the extent of any potential exposure.

A database flaw in a business directory tool.
Potential for unauthorized data access or changes.
Confirm relevance and exposure of the tool.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by submitting specially crafted search queries through the public-facing J-BusinessDirectory extension. Since the search keywords and ordering parameters were directly concatenated into the SQL query without proper sanitization, an attacker could manipulate these inputs to inject malicious SQL code. This could lead to unauthorized access to or modification of sensitive data within the business directory database.

No authentication or user interaction needed.
Malicious SQL injection via search keywords.
Compromise of sensitive database information.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system data and service behavior when users interact with the search functionality of the J-BusinessDirectory extension. Specifically, search keywords and the order in which results are displayed could be manipulated through SQL injection.

System search data could be exposed.
Malicious SQL queries could be injected.
Service availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in a Joomla extension affects public-facing business directory search functions. The first step is to identify all instances of the affected extension, determine their accessibility, confirm business criticality, and assign ownership to a specific team for risk-based remediation planning.

Application owners should address the issue.
Verify external reachability and business criticality.
Plan remediation based on exposure and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the J-BusinessDirectory extension?

J-BusinessDirectory is an add-on for the Joomla content management system, created by cmsjunkie.com. It is designed to help website administrators build and manage directory-style listings, such as local business finders, which users interact with through web browsers to search for services, locations, or business data.

What does SQL injection mean for CVE-2026-75954?

This vulnerability falls under the class of Improper Neutralization of Special Elements used in an SQL Command, or CWE-89. In this CVE, the extension incorrectly handled search inputs by combining them directly into database instructions. This allows an attacker to inject their own database commands, effectively tricking the system into revealing or modifying information it should keep private.

How is this SQL injection triggered?

An attacker triggers this by submitting manipulated input into the search or sorting fields provided by the extension. Simply navigating to the site without using the search feature does not trigger the bug, as it specifically requires interaction with the vulnerable input parameters where the application fails to properly clean or restrict the data before processing it.

Is my site at risk from this vulnerability?

Halo Surface Signal indicates that because this extension powers public-facing search functions, it is likely accessible from the internet. If you use J-BusinessDirectory, your application is a potential target because the search interface is designed to be reachable by external users, making it an entry point that does not require the attacker to have an account or login.

How should I respond to this threat?

Begin by auditing your Joomla environment to locate any instances of J-BusinessDirectory. Once identified, confirm which versions are running to see if they are older than 6.2.3. If you are using an older version, prioritize updating the extension to 6.2.3 or later, as this version specifically adds safety measures to correctly handle search keywords and sort commands.

References

www.cmsjunkie.com/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.