Unauthenticated Stored XSS in Balbooa Forms Joomla Extension

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Balbooa Forms Joomla extension versions before 2.4.3.4. It allows unauthenticated attackers to upload malicious files. The extension stores the original filename without sanitization, and when an administrator views a submission, the filename is rendered as HTML, executing arbitrary JavaScript in their browser.

Useful 0 Not Useful 0

Detection Guidance

Check if Balbooa Forms version is below 2.4.3.4 by inspecting the Joomla extension list. Look for unusual file uploads in the #__baforms_submissions_attachments table or suspicious HTML content in form submissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions as the admin, or deface the website. Since it requires no authentication, it is easy to exploit remotely. Administrators viewing submissions are the primary targets, leading to potential full site compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking breaches of safeguards. Both standards mandate protection against such attacks to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update Balbooa Forms to version 2.4.3.4 or later. Review and remove any suspicious uploaded files. Monitor administrator access logs for unexpected form submissions.

Useful 0 Not Useful 0