Critical RCE in Balbooa Forms via Shortcode Injection

CVE-2026-102425 is a critical vulnerability (CVSS 9.5) affecting the Balbooa Forms extension (com_baforms) for Joomla, versions 1.0.0 through 2.4.3.3. The flaw is rooted in how the component processes PHP code configured to run after a form submission. Administrators can define PHP snippets that include form-field shortcodes; however, the component fails to sanitize these values before passing them to an eval() function. An unauthenticated remote attacker can supply malicious input via a public form submission, breaking out of a double-quoted string to execute arbitrary PHP code on the server.

This vulnerability requires specific configuration: the site must have a public form that utilizes the "PHP-after-submission" feature containing field or URL shortcodes. Because a functional exploit proof-of-concept is publicly available, organizations using affected versions of Balbooa Forms are at immediate risk of compromise.

Attack Chain

1. Attacker discovers a Joomla site running an vulnerable version of com_baforms (v1.0.0 - 2.4.3.3).
2. Attacker probes the target by sending a GET request to index.php with the task=form.loadAjaxForm parameter to identify form IDs.
3. Attacker identifies a public form that utilizes the "PHP-after-submission" action.
4. Attacker constructs a malicious payload designed to break out of the PHP double-quoted string (e.g., "; system('id'); //).
5. Attacker sends a POST request to the form action with task=form.message containing the malicious payload in a form field.
6. The server-side component replaces the form shortcode with the attacker's payload and executes the resulting string via eval().
7. The injected PHP code executes on the web server, allowing for unauthorized command execution or the dropping of webshells such as up.php.

Impact

Successful exploitation results in full remote code execution, granting attackers the ability to manipulate the underlying server, exfiltrate data, or establish persistence. Vulnerable sites may be subject to automated mass-exploitation, as evidenced by the availability of scripting tools that support automated scanning and remote shell deployment in common Joomla directories like images/baforms/uploads/.

Recommendation

1. Immediately upgrade Balbooa Forms to version 2.4.3.4 or higher to patch CVE-2026-102425.
2. Audit all forms for "PHP-after-submission" actions and temporarily disable those utilizing field or URL shortcodes until the patch is applied.
3. Implement reCAPTCHA on all public-facing forms to mitigate automated exploitation attempts.
4. Inspect the directory images/baforms/uploads/ and other common upload paths for unauthorized PHP files or unexpected modifications.
5. Deploy the provided webserver detection rule to identify attempted code injection via form submission tasks.