The J‑BusinessDirectory extension for Joomla is vulnerable to an unsanitized SQL injection through its search function. Search keywords and the ORDER BY clause are directly concatenated into a SQL statement without proper quoting or whitelisting. This flaw allows an attacker to inject arbitrary SQL, potentially altering database contents, retrieving sensitive information, or executing destructive commands. The weakness is a classic example of CWE‑89.

The vulnerability affects the Joomla J‑BusinessDirectory extension provided by cmsjunkie.com. Any site using a version earlier than 6.2.3 is impacted, while the 6.2.3 release fixes the issue by quoting search terms and enforcing a whitelist of allowed sort fields.

The CVSS score of 9.3 classifies this flaw as critical. The EPSS score is 0.28%, indicating a very low but non-zero likelihood of exploitation; it is also not listed in the CISA KEV catalog, so no known widespread attacks are documented. The likely attack vector is a public search request, meaning an unauthenticated or low‑privileged user can trigger the injection. Successful exploitation would compromise confidentiality, integrity, and availability of the underlying data and could lead to broader system compromise.