Official Product Homepageproduct
http://cmsjunkie.com/ CVE-2019-25752
HIGH
Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection
Record summary
CVE-2019-25752 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=com_jbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to extract database information including schema names and sensitive data.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 22, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
J-BusinessDirectoryBrowse Cmsjunkie / J-BusinessDirectory | CVE List | 4.9.7 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJoomla! Component J-BusinessDirectory 4.9.7 - 'type' SQL InjectionExploitDB exploitby Ihsan SencanNot analyzed1 file
References
5Product Referenceproduct
https://extensions.joomla.org/extensions/extension/directory-a-documentation/directory/j-businessdirectory nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25752 ExploitDB-46230exploit
https://www.exploit-db.com/exploits/46230 VulnCheck Advisory: Joomla! Component J-BusinessDirectory 4.9.7 SQL InjectionThird-party advisory
https://www.vulncheck.com/advisories/joomla-component-j-businessdirectory-sql-injection