CyberRota Analysis
AI-GeneratedThe J-BusinessDirectory extension for Joomla versions prior to 6.2.3 is vulnerable to cross-site request forgery (CSRF) due to missing tokens on various AJAX and state-changing tasks, including contact forms, cart operations, and administrative actions. This vulnerability could allow an attacker to perform unauthorized actions on behalf of users with valid sessions, potentially compromising sensitive data or altering system configurations. Joomla administrators and users of the J-BusinessDirectory extension should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions (app install, demo-data wipe, cache/statistics archive, payment notification send, mobile push). Frontend CSRF needs a registered/listing-owner session; admin CSRF needs a backend admin session.