CVE-2026-75954

The CVSS 9.3 rating for this SQL injection in J-BusinessDirectory's trips search is almost certainly inflated. The pre-auth assumption that drives the high base score is questionable—the endpoint's authentication requirements should be verified before accepting the severity at face value. But the more important problem isn't the CVSS math; it's that the remediation itself creates a durable vulnerability surface that will generate future CVEs unless the vendor's development practice changes permanently. The fix allows-list the ORDER BY clause. This is the correct technical response to ORDER BY injection—you cannot use standard parameterized queries for column identifiers—but it introduces a maintenance burden that most organizations fail to sustain. Every time a developer adds a new sortable column to the trips search, they must remember to add it to the allow-list or the injection surface reopens exactly as it existed before. This isn't a tooling gap or a training gap; it's an organizational inertia problem. The developer who understands the allow-list requirement may leave, be reassigned, or simply forget. Six months after this patch, the next developer adds a sortable column and doesn't know it needs to be allow-listed. The secondary fix—quoting keywords—is weaker and likely represents legacy debt rather than genuine remediation. If the vendor used escape functions rather than true parameterized queries for the keyword parameter, the patch merely obscures the injection point rather than closing it. What you should check: verify whether the trips_search endpoint requires authentication, because that determines whether the CVSS pre-auth vector is realistic. Examine the patch to confirm the ORDER BY fix uses a strict allow-list (array of permitted values) rather than a blocklist. For the keyword parameter, confirm the fix moved to prepared statements rather than wrapping the input with escape functions. If it only added escaping, treat the injection risk as unmitigated until the query is refactored. The deeper question is whether cmsjunkie.com has documented secure development practices for ORDER BY injection now—or whether they're patching reactively while the same pattern incubates for the next CVE. Based on the historical pattern in commercial extension ecosystems, assume the latter unless you see evidence of process change. The EPSS score of 0.00281 reflects the smaller attacker pool (commercial extension, not Joomla core), but doesn't account for the high-value business data in directory listings—travel operators, bookings, user accounts—that makes targeted exploitation against unpatched installs attractive.

Reviewed through automated stages and approved by a human before publication.