CVE-2026-75954: Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3

Q: Which deployments are affected?

J-BusinessDirectory versions earlier than 6.2.3 are affected. Version 6.2.3 addresses the issue by quoting search keywords and restricting the sort clause to an allow-list.

Q: What inputs are involved in the injection risk?

The vulnerable trips search handling concatenated search keywords and the ORDER BY value into SQL. An attacker would need to control values submitted to those search inputs.

Q: What can be done if upgrading is not immediately possible?

The provided information does not identify a workaround. Prioritize upgrading to 6.2.3, which adds keyword quoting and allow-list validation for the sort clause.

Published Aug 19, 2026

Updated

Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause.

Affected Software

1 affected component

cmsjunkie.com J-BusinessDirectory<6.2.3

Event History

Aug 19, 2026

CVE Published

via MITRE·02:41 PM

Data Sourced

via MITRE·02:41 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

J-BusinessDirectory versions earlier than 6.2.3 are affected. Version 6.2.3 addresses the issue by quoting search keywords and restricting the sort clause to an allow-list.

What inputs are involved in the injection risk?

The vulnerable trips search handling concatenated search keywords and the ORDER BY value into SQL. An attacker would need to control values submitted to those search inputs.

What can be done if upgrading is not immediately possible?

The provided information does not identify a workaround. Prioritize upgrading to 6.2.3, which adds keyword quoting and allow-list validation for the sort clause.