Executive brief
Balbooa Joomla Forms Builder is a popular extension used to create and manage custom forms on Joomla websites. A security flaw in how the software handles form submissions allows unauthorized individuals to access and extract sensitive information from the website's database. This could lead to the exposure of user data, administrative credentials, or other confidential business information stored on the server.
Technical details
An unauthenticated SQL injection vulnerability exists in Balbooa Joomla Forms Builder version 2.0.6 and potentially earlier versions. The flaw is located within the form submission handler of the com_baforms component. Attackers can exploit this by sending a specially crafted POST request containing a malicious JSON payload in the 'id' field parameter. Because the input is not properly neutralized before being used in an SQL command (CWE-89), a remote, unauthenticated attacker can execute arbitrary SQL queries to extract sensitive data from the underlying database. Public exploit code is available for this vulnerability.
Affected products
- Balbooa Joomla Forms Builder <= 2.0.6
Timeline
- 2021-10-24: disclosed: Initial discovery and exploit publication by blockomat2100
- 2026-05-10: advisory: CVE-2021-47930 published by VulnCheck/NVD