CVE-2026-75954: J-BusinessDirectory SQL Injection Flaw

CVE-2026-75954 Overview

CVE-2026-75954 is a SQL injection vulnerability in the J-BusinessDirectory Joomla extension developed by CMS Junkie. The flaw affects versions prior to 6.2.3 and resides in the trips search functionality. The extension concatenates user-supplied search keywords and ORDER BY parameters directly into SQL statements without sanitization. Unauthenticated remote attackers can inject arbitrary SQL through the search interface. The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. Version 6.2.3 remediates the issue by quoting keywords and enforcing an allow-list for the sort clause.

Critical Impact
Unauthenticated attackers can extract, modify, or destroy backend database contents through the trips search endpoint.

Affected Products

J-BusinessDirectory Joomla extension versions prior to 6.2.3
Joomla sites running the CMS Junkie J-BusinessDirectory trips search feature
CMS Junkie commercial Joomla extension portfolio (trips search component)

Discovery Timeline

2026-08-19 - CVE-2026-75954 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-75954

Vulnerability Analysis

The vulnerability resides in the trips search handler of the J-BusinessDirectory extension. User input from the search keyword parameter and the ORDER BY clause is concatenated directly into a SQL query string. The extension does not apply parameterized queries, escaping, or an allow-list for sortable columns before execution.

An attacker submits crafted search keywords or sort parameters to the trips search endpoint. The injected SQL is passed to the Joomla database driver and executed with the privileges of the Joomla database user. This grants read and write access to the entire Joomla schema, including user credentials and session tables.

Exploitation does not require authentication or user interaction. Any visitor able to reach the public trips search page can trigger the flaw.

Root Cause

The root cause is unsafe string concatenation of untrusted input into SQL statements. Two sinks contribute to the vulnerability. First, the search keyword variable is embedded in a WHERE clause without quoting or parameter binding. Second, the sort parameter used to construct the ORDER BY clause is not validated against an allow-list of column names. Version 6.2.3 addresses both sinks by quoting keywords and restricting sort values to a known column list.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker crafts a request to the trips search endpoint with malicious SQL payloads in the keyword or sort parameters. Because the search feature is publicly accessible, no session, cookie, or CSRF token is required. Attackers can automate boolean-based or UNION-based extraction to enumerate database contents. Time-based blind techniques also apply against the ORDER BY sink.

Refer to the CMS Junkie site for vendor advisory information and the patched release notes.

Detection Methods for CVE-2026-75954

Indicators of Compromise

HTTP requests to J-BusinessDirectory trips search URLs containing SQL metacharacters such as UNION SELECT, SLEEP(, '--, or ; in keyword or sort parameters
Unexpected ORDER BY values in access logs that reference subqueries, CASE statements, or function calls
Database error messages returned in HTTP responses referencing MySQL syntax near user-supplied strings
Anomalous SELECT queries against #__users, #__session, or configuration tables originating from the Joomla application user

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL keywords and quote characters in the trips search keyword and sort parameters
Enable database query logging and alert on queries containing suspicious ORDER BY expressions or nested SELECT statements from the Joomla connection
Inspect Joomla access logs for repeated requests to the trips search endpoint from a single source with varying payloads

Monitoring Recommendations

Correlate WAF alerts with backend database error rates to identify successful injection attempts
Monitor outbound data volume from the database server for signs of bulk extraction
Track failed login attempts and privilege changes following suspicious search traffic to catch credential theft follow-on activity

How to Mitigate CVE-2026-75954

Immediate Actions Required

Upgrade the J-BusinessDirectory extension to version 6.2.3 or later on all Joomla instances
Audit Joomla access and database logs for signs of prior exploitation against the trips search endpoint
Rotate database credentials and Joomla administrator passwords if evidence of compromise is found
Review installed Joomla extensions and remove unused CMS Junkie components to reduce attack surface

Patch Information

CMS Junkie released J-BusinessDirectory 6.2.3, which quotes user-supplied search keywords before they are embedded in SQL and applies an allow-list to the sort clause used in ORDER BY. Administrators should download the update through the Joomla extension manager or from the CMS Junkie site.

Workarounds

Restrict access to the trips search endpoint using WAF or reverse proxy rules until the patch is applied
Disable the trips module in the J-BusinessDirectory configuration if the feature is not required
Apply generic SQL injection filtering at the perimeter for requests targeting index.php with the J-BusinessDirectory component identifier

bash

# Example WAF rule (ModSecurity) blocking common SQLi tokens on the trips search endpoint
SecRule REQUEST_URI "@contains option=com_jbusinessdirectory" \
  "chain,phase:2,deny,status:403,id:1075954,msg:'CVE-2026-75954 SQLi attempt'"
  SecRule ARGS:keyword|ARGS:orderby "@rx (?i)(union\s+select|sleep\(|--|;|/\*)" "t:none"