Pre-auth PHP Code Injection in Balbooa Forms

Executive Summary

This is a pre-authentication PHP code injection vulnerability in the Balbooa Forms Joomla extension versions before 2.4.3.2. It allows unauthenticated attackers to execute arbitrary PHP code on the server by injecting it via a query parameter. The vulnerability occurs because the extension uses eval() to execute a custom-PHP post-submission handler, and the handler includes an unescaped shortcode that substitutes a query parameter value directly.

Useful 0 Not Useful 0

Detection Guidance

Check if Balbooa Forms version is below 2.4.3.2. Inspect form configurations for custom-PHP handlers using the [URL parameter = X] shortcode. Review server logs for eval() calls with user-supplied input.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to take full control of your Joomla website, steal sensitive data, install malware, or deface the site. Since it requires no authentication and the CSRF token is exposed, the attack surface is significant if the form has a custom-PHP handler configured.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, triggering legal penalties, fines, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update Balbooa Forms to version 2.4.3.2 or later. Remove any custom-PHP handlers in forms. Disable the vulnerable endpoint if not needed. Add reCAPTCHA to submit buttons.

Useful 0 Not Useful 0