CVE-2026-75955 in J-BusinessDirectory Extension
Summary
by MITRE • 08/19/2026
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XML attribute.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified in Joomla extension J-BusinessDirectory versions prior to 6.2.3 represents a critical security flaw rooted in improper input validation and output encoding mechanisms. Specifically, the application fails to adequately sanitize or encode user-supplied data before incorporating it into dynamically generated XML structures. This lack of robust sanitization allows an attacker to inject malicious payloads directly into the application's processing logic through specific form fields, most notably the company name parameter during directory submission or editing processes. The core technical deficiency lies in the direct concatenation of unsanitized user input into XML attribute values without applying appropriate escaping sequences for special characters such as quotes, ampersands, and angle brackets. This behavior creates a classic injection vector where external data is interpreted as executable code by the underlying parser rather than being treated strictly as literal text content.
From a technical perspective, this flaw manifests primarily as an XML Injection vulnerability with secondary capabilities leading to Reflected Cross-Site Scripting depending on how the injected payload is rendered in subsequent HTTP responses. When an attacker submits a crafted company name containing malicious script tags or XML entity definitions, the application writes these strings directly into an XML document structure. If the resulting XML data is subsequently processed by a browser-based client-side parser that interprets HTML entities within attributes, the embedded JavaScript code can execute in the context of the victim's session. This dual nature of the vulnerability allows for both server-side manipulation of XML structures and client-side execution of arbitrary scripts, significantly expanding the attack surface beyond traditional web application flaws. The reflection aspect implies that the malicious payload is immediately returned to the user within an HTTP response, facilitating phishing attacks or direct exploitation without requiring persistent storage on the target system.
The operational impact of this vulnerability is severe due to its potential for unauthorized access and data compromise. Successful exploitation enables attackers to perform session hijacking by stealing administrative cookies through JavaScript execution in a privileged context. This can lead to full account takeover, allowing modification of directory listings, insertion of fraudulent business entries, or deletion of legitimate records. Furthermore, the XML injection capability may allow attackers to bypass server-side validation rules or manipulate backend data structures if the application processes the malformed XML further down the pipeline. In worst-case scenarios involving server-side parsing libraries with external entity processing enabled, this could potentially lead to Server-Side Request Forgery or local file inclusion attacks, although such outcomes depend heavily on specific server configurations and library versions used by the extension developer.
This vulnerability aligns closely with Common Weakness Enumeration identifiers CWE-79 for Improper Neutralization of Input During Web Page Generation which covers cross-site scripting scenarios, as well as CWE-611 for XML External Entity injection when external entities are processed. In terms of tactical classification under MITRE ATT&CK frameworks, this flaw facilitates techniques related to Client-Side Scripting and potentially Data Injection depending on the depth of exploitation. The lack of output encoding is a fundamental design error that violates secure coding principles emphasizing defense in depth through strict input validation and context-aware output escaping.
Mitigation strategies must prioritize immediate patching by upgrading J-BusinessDirectory to version 6.2.3 or later where these sanitization routines have been corrected. For organizations unable to upgrade immediately, implementing a Web Application Firewall with rulesets capable of detecting XML injection patterns and reflected XSS payloads can provide temporary protection against exploitation attempts. Additionally, developers should enforce strict Content Security Policy headers that restrict inline script execution, thereby mitigating the impact even if an attacker successfully injects malicious code into the company name field. Long-term remediation requires adopting secure coding standards that mandate parameterized queries for database interactions and rigorous encoding of all dynamic content based on its output context to prevent interpretation as executable commands by parsers or browsers.