CyberRota Analysis
AI-GeneratedThe vulnerability affects the Balbooa Forms extension for Joomla versions prior to 2.4.3.2, allowing unauthenticated attackers to execute arbitrary PHP code on the server due to improper handling of user input in the custom-PHP post-submission handler. This critical flaw, which has a CVSS score of 10.0, poses significant risks including complete system compromise, as it allows for high-level access and control over the affected server. Organizations using this extension, especially those with custom-PHP handlers configured and without reCAPTCHA on their forms, should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.