This vulnerability requires specific configuration: the site must have a public form that utilizes the "PHP-after-submission" feature containing field or URL shortcodes. Because a functional exploit proof-of-concept is publicly available, organizations using affected versions of Balbooa Forms are at immediate risk of compromise.

Attack Chain

1. Attacker discovers a Joomla site running an vulnerable version of com_baforms (v1.0.0 - 2.4.3.3).
2. Attacker probes the target by sending a GET request to index.php with the task=form.loadAjaxForm parameter to identify form IDs.
3. Attacker identifies a public form that utilizes the "PHP-after-submission" action.
4. Attacker constructs a malicious payload designed to break out of the PHP double-quoted string (e.g., "; system('id'); //).
5. Attacker sends a POST request to the form action with task=form.message containing the malicious payload in a form field.
6. The server-side component replaces the form shortcode with the attacker's payload and executes the resulting string via eval().
7. The injected PHP code executes on the web server, allowing for unauthorized command execution or the dropping of webshells such as up.php.

Impact

Successful exploitation results in full remote code execution, granting attackers the ability to manipulate the underlying server, exfiltrate data, or establish persistence. Vulnerable sites may be subject to automated mass-exploitation, as evidenced by the availability of scripting tools that support automated scanning and remote shell deployment in common Joomla directories like images/baforms/uploads/.

Recommendation

1. Immediately upgrade Balbooa Forms to version 2.4.3.4 or higher to patch CVE-2026-102425.
2. Audit all forms for "PHP-after-submission" actions and temporarily disable those utilizing field or URL shortcodes until the patch is applied.
3. Implement reCAPTCHA on all public-facing forms to mitigate automated exploitation attempts.
4. Inspect the directory images/baforms/uploads/ and other common upload paths for unauthorized PHP files or unexpected modifications.
5. Deploy the provided webserver detection rule to identify attempted code injection via form submission tasks.