CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions (app install, demo-data wipe, cache/statistics archive, payment notification send, mobile push). Frontend CSRF needs a registered/listing-owner session; admin CSRF needs a backend admin session.
Explanation of Vulnerability in Simple Terms
The J-BusinessDirectory extension for Joomla contains a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a high-privilege user. An attacker must craft a malicious page and trick a logged-in administrator into visiting it. The vulnerability can result in modification of directory data or settings.
What an attacker can do
Perform unauthorized actions on the site by tricking an admin into visiting a malicious page.
Potential impact on your site
Directory data or extension settings could be modified without the admin's knowledge or consent.
Conditions required to exploit
Administrator must be logged in and visit an attacker-controlled page; attacker has no direct access.
Key dates
External resources
Related vulnerabilities
