CVE-2019-25752: Joomla! Component J-BusinessDirectory 4.9.7 SQL Injection
Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=comjbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to extract database information including schema names and sensitive data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Joomla! Component J-BusinessDirectory 4.9.7from your environment.Uninstall the J-BusinessDirectory component if it is not required to eliminate the vulnerable code path.
- Configuration
Disable the J-BusinessDirectory component in the Joomla administrator to prevent access to its endpoints (including index.php?option=com_jbusinessdirectory&task=categories.getCategories).
Joomla! Component J-BusinessDirectory enabled = false - Configuration
Configure Joomla ACL or component settings to require authentication and restrict access to the categories.getCategories task to trusted/privileged users only.
Joomla! Component J-BusinessDirectory access_control = authenticated only - Compensating control
Apply network/WAF controls to block or restrict requests to index.php?option=com_jbusinessdirectory&task=categories.getCategories and to filter or block suspicious payloads in the 'type' parameter (or restrict access to the endpoint to trusted IPs).
- Operational
Audit web and database logs for evidence of exploitation (requests to the vulnerable endpoint or UNION-based SQL in the 'type' parameter). If compromise is suspected, rotate database credentials, API keys, and restore affected data from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25752?
CVE-2019-25752 has been assigned a severity score of 8.8, indicating a high risk to affected systems.
How do I fix CVE-2019-25752?
To fix CVE-2019-25752, update the J-BusinessDirectory component to the latest version provided by its maintainers.
What type of vulnerability is CVE-2019-25752?
CVE-2019-25752 is an SQL injection vulnerability that affects the J-BusinessDirectory Joomla component.
Who can exploit CVE-2019-25752?
CVE-2019-25752 can be exploited by unauthenticated attackers who can send specially crafted GET requests.
What is the impact of CVE-2019-25752 on affected systems?
The impact of CVE-2019-25752 allows attackers to execute arbitrary SQL queries, potentially compromising the database.