critical
Balbooa Forms for Joomla (versions prior to 2.4.1)
A drag-and-drop form builder for Joomla websites that lets site owners create contact forms with file upload functionality.
Root Cause
The upload feature lacks validation on file type. Think of it as a secure post box with a slot wide enough to fit a crowbar — the opening exists for legitimate use, but nothing checks what comes through it.
Attack Vector
An attacker visits a Joomla site running the vulnerable plugin, submits a PHP file through the public-facing upload form, then navigates directly to that file's URL on the server to execute it. This worked as a zero-day from July 8, one day before a patch was released.
Recommended Actions
- Update Balbooa Forms to version 2.4.1 immediately.
- Audit your server for unexpected PHP files in upload directories.
- If you cannot patch immediately, disable file upload functionality in the plugin settings.