The vulnerability arises from the lack of strict typing for pagination input in the J-BusinessDirectory extension. Malicious requests that include non-numeric or array values for the limitstart parameter trigger PHP type errors, and unvalidated limit values are used directly in database queries. This can cause resource exhaustion or unhandled errors, bringing the affected Joomla site to a halt, which is the core denial‑of‑service impact of this weakness, classified as CWE‑770.

Affected are Joomla sites that have the J‑BusinessDirectory component from cmsjunkie.com installed in versions prior to 6.2.3. The component is a commercial extension for the Joomla CMS, and the exploit only requires access to the web interface that uses the pagination feature. No other system components are directly mentioned as affected.

The CVSS score of 8.7 indicates a high severity of impact. With no EPSS score available and absence from the KEV catalog, the likelihood of exploitation remains uncertain, but the vector is remote via HTTP requests to the pagination endpoint. An attacker can trigger the denial of service by submitting crafted pagination values, so mitigation should prioritize patching or input validation to prevent unbounded resource use.