CVE-2019-25752: J-BusinessDirectory SQLi Vulnerability

CVE-2019-25752 Overview

CVE-2019-25752 is an SQL injection vulnerability [CWE-89] affecting the Joomla! component J-BusinessDirectory version 4.9.7. The flaw resides in the handling of the type parameter passed to index.php when invoking option=com_jbusinessdirectory&task=categories.getCategories. Unauthenticated attackers can send crafted GET requests containing UNION-based SQL payloads to extract database schema, credentials, and other sensitive records. The vulnerability requires no authentication, no user interaction, and is exploitable over the network.

Critical Impact
Unauthenticated remote attackers can extract arbitrary database contents from Joomla! sites running J-BusinessDirectory 4.9.7 via UNION-based SQL injection in the type parameter.

Affected Products

Joomla! Component J-BusinessDirectory 4.9.7
Joomla! sites with com_jbusinessdirectory extension installed and enabled
CMS Junkie J-BusinessDirectory extension distributions at version 4.9.7

Discovery Timeline

2026-06-19 - CVE-2019-25752 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25752

Vulnerability Analysis

The J-BusinessDirectory component exposes the categories.getCategories task through the Joomla! front-controller endpoint index.php. The handler reads the type request parameter and concatenates the value directly into a SQL statement without parameterization or input sanitization. Because the injection point sits inside a SELECT query, attackers can append a UNION SELECT clause to retrieve arbitrary columns from any table the component's database user can read.

The vulnerability falls under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). With an EPSS score of 0.366% (28.4 percentile), opportunistic scanning is plausible but not yet prevalent. No CISA KEV listing exists, and no confirmed in-the-wild exploitation has been recorded.

Root Cause

The root cause is the absence of input validation and prepared statements when the component constructs the categories query. User-controlled data from the type GET parameter reaches the database driver as concatenated SQL text. Joomla!'s database abstraction provides parameter binding APIs, but the affected code path does not use them for this parameter.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to a vulnerable Joomla! installation. The request targets index.php with the query string option=com_jbusinessdirectory&task=categories.getCategories and supplies a malicious type parameter containing a UNION-based payload. Successful exploitation returns the injected query results in the HTTP response, enabling enumeration of database schemas, table contents, administrator credentials, and session tokens.

A public proof-of-concept is documented in Exploit-DB entry 46230. See the Exploit-DB #46230 entry and the VulnCheck Joomla SQL Injection Advisory for request structure details.

Detection Methods for CVE-2019-25752

Indicators of Compromise

HTTP GET requests to index.php containing both option=com_jbusinessdirectory and task=categories.getCategories with non-numeric or SQL-keyword values in the type parameter.
Web server access logs showing URL-encoded SQL keywords such as UNION, SELECT, information_schema, 0x, or -- within the type query parameter.
Database error messages or stack traces returned in responses from com_jbusinessdirectory endpoints, indicating malformed injected payloads.
Sudden spikes in outbound responses with abnormally large payload sizes from the categories.getCategories handler.

Detection Strategies

Deploy WAF signatures that flag SQL meta-characters and UNION-based patterns in query parameters destined for com_jbusinessdirectory.
Enable Joomla! database query logging and alert on queries that reference information_schema originating from the J-BusinessDirectory component.
Correlate web access logs with database audit logs to identify anomalous read access against credential or session tables.

Monitoring Recommendations

Monitor for repeated 200-status responses with varying type parameter values from a single source IP within short time windows.
Track web application response sizes for the categories.getCategories task and alert on statistical outliers.
Forward Joomla! and web server logs to a centralized analytics platform to enable retroactive hunting for UNION-based payloads.

How to Mitigate CVE-2019-25752

Immediate Actions Required

Inventory all Joomla! installations and identify sites running J-BusinessDirectory 4.9.7 or earlier.
Disable the com_jbusinessdirectory component on affected sites until an updated version is installed and verified.
Restrict network access to administration and category endpoints behind authentication or IP allow-listing where feasible.
Review web and database logs for prior exploitation attempts dating back to the component's installation.

Patch Information

No specific patched version is referenced in the NVD entry for CVE-2019-25752. Administrators should consult the vendor at CMS Junkie and the Joomla Extension Directory listing for J-BusinessDirectory for the latest release and confirm that the categories.getCategories handler uses parameterized queries.

Workarounds

Deploy a web application firewall rule blocking requests to index.php?option=com_jbusinessdirectory&task=categories.getCategories that contain SQL keywords in the type parameter.
Enforce strict input validation at a reverse proxy by rejecting non-integer values for the type parameter.
Reduce the privileges of the Joomla! database user so the component cannot read sensitive tables such as #__users or information_schema.
Rotate administrator credentials and active session secrets if log review indicates possible exploitation.

bash

# Example ModSecurity rule to block UNION-based payloads against the vulnerable endpoint
SecRule REQUEST_URI "@contains com_jbusinessdirectory" \
  "chain,phase:2,deny,status:403,id:1925752,\
   msg:'CVE-2019-25752 J-BusinessDirectory SQLi attempt'"
  SecRule ARGS:type "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|0x[0-9a-f]+|--|;)" \
    "t:none,t:urlDecodeUni"