The J-BusinessDirectory extension for Joomla versions 1.0.0 to 6.2.2 suffers from a CSRF vulnerability (CWE-352) due to missing anti-CSRF tokens on multiple AJAX and state-changing operations. This includes frontend features such as contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and backend administrator actions like app installation, demo-data wiping, cache/statistics archiving, payment notification sending, and mobile push notifications. Successful exploitation requires the attacker to have an active session with appropriate privileges (registered user or admin).

An attacker with a valid session can trick a user or administrator into performing unintended actions on the vulnerable Joomla extension via CSRF attacks. This could lead to unauthorized changes such as modifying listings, sending payment notifications, wiping demo data, or other state-changing operations. However, exploitation requires the victim to be authenticated, limiting the scope to users with active sessions.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, restricting access to trusted users and minimizing session exposure can reduce risk. Avoid clicking on untrusted links while authenticated to the affected system. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.