CVE-2026-75956 Overview
CVE-2026-75956 is a denial-of-service vulnerability affecting the J-BusinessDirectory Joomla extension developed by cmsjunkie.com in versions prior to 6.2.3. The flaw resides in the extension's pagination parameter handling logic. Pagination values are not strictly typed, allowing attackers to submit array or non-numeric values such as limitstart[] that trigger PHP type errors during arithmetic operations. Additionally, the limit parameter is not validated before use in list queries. Unauthenticated remote attackers can exploit this weakness to disrupt directory availability. The issue is classified under [CWE-770] Allocation of Resources Without Limits or Throttling.
Critical Impact
Unauthenticated remote attackers can trigger application errors and degrade availability of J-BusinessDirectory instances by supplying malformed pagination parameters.
Affected Products
- cmsjunkie J-BusinessDirectory Joomla extension versions prior to 6.2.3
- Joomla sites deploying J-BusinessDirectory for business listings
- Fixed in J-BusinessDirectory 6.2.3
Discovery Timeline
- 2026-08-19 - CVE-2026-75956 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-75956
Vulnerability Analysis
The vulnerability affects the pagination parameter processing routine within J-BusinessDirectory. The extension accepts user-supplied limitstart and limit values from HTTP request parameters without enforcing strict type validation. When PHP performs arithmetic on these parameters, an attacker-supplied array such as limitstart[]=1 causes the interpreter to raise a TypeError, aborting request handling and generating error output. The limit parameter also lacks validation before being used in list query construction. This allows abusive values that consume server resources or produce runtime failures.
Root Cause
The root cause is missing input validation and type coercion for pagination parameters. The application trusts request-supplied values and passes them directly into arithmetic expressions and query-building logic. Because PHP 8+ raises type errors on non-numeric arithmetic operations, malformed inputs produce unhandled exceptions. The absence of an upper bound on limit compounds the issue by enabling resource-heavy queries against the underlying database.
Attack Vector
An unauthenticated remote attacker sends crafted HTTP GET requests to any J-BusinessDirectory endpoint that consumes pagination parameters. Supplying limitstart as an array or non-numeric string forces a PHP type error. Supplying an oversized limit value forces the backend to prepare and execute an unbounded list query. Repeated requests amplify the impact and can render the directory feature unresponsive. No authentication, user interaction, or privileges are required. See the CMS Junkie Blog for vendor communications.
Detection Methods for CVE-2026-75956
Indicators of Compromise
- HTTP request logs containing limitstart[]= array-style parameters targeting Joomla component routes
- Requests with non-numeric or extremely large limit query parameter values
- PHP error logs referencing TypeError in J-BusinessDirectory component files
- Spikes in 500-series HTTP responses from /index.php?option=com_jbusinessdirectory endpoints
Detection Strategies
- Inspect web server access logs for pagination parameters that deviate from numeric integer values
- Correlate PHP TypeError exceptions with inbound requests targeting J-BusinessDirectory routes
- Monitor database query duration and row-count anomalies tied to J-BusinessDirectory list views
Monitoring Recommendations
- Alert on repeated 5xx responses originating from Joomla component endpoints
- Track outbound WAF blocks matching array-notation pagination parameters
- Baseline average response times for directory listing pages and flag sustained deviations
How to Mitigate CVE-2026-75956
Immediate Actions Required
- Upgrade J-BusinessDirectory to version 6.2.3 or later on all Joomla installations
- Enable a web application firewall rule that rejects array-notation pagination parameters
- Review PHP and Joomla error logs for prior exploitation attempts
Patch Information
The vendor released a fix in J-BusinessDirectory 6.2.3 that enforces strict typing on limitstart and validates limit before use in list queries. Administrators should apply the update through the Joomla extension manager. Refer to the CMS Junkie site for release notes.
Workarounds
- Deploy WAF signatures that block requests containing limitstart[] or non-numeric pagination values
- Cap the maximum accepted limit value at the reverse proxy or WAF layer
- Restrict access to J-BusinessDirectory pages behind authentication where feasible until patching
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
