The vulnerability arises from the lack of strict typing for pagination input in the J-BusinessDirectory extension. Malicious requests that include non-numeric or array values for the limitstart parameter trigger PHP type errors, and unvalidated limit values are used directly in database queries. These mistakes can exhaust server resources or cause unhandled errors, effectively taking the affected Joomla site offline.

Affected are Joomla sites that have the J‑BusinessDirectory component from cmsjunkie.com installed in versions before 6.2.3. The extension is a commercial module for the Joomla CMS, and the flaw only requires that the web interface use the pagination feature. No other Joomla components are indicated as affected.

The CVSS score of 8.7 indicates a high severity out of 10. The EPSS score is reported as < 1 %, suggesting the likelihood of exploitation is low but not negligible, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via HTTP requests to the pagination endpoint. An attacker can trigger the denial of service by submitting crafted pagination values, such as array or non-numeric limitstart inputs, causing PHP type errors or unbounded database queries. The impact is a denial of service against the affected Joomla site.