Łukasz Rybak

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordController`. Its shared frontend save controller accepts the raw `jform` array, assigns the request-selected existing record ID, and saves it without filtering submitted properties through the configured form. A Guest can obtain a valid token from Joomla's public login form and modify any TF Content row, including mass-assigning `published`, `access`, and `created by`.

The extension exposes the site task `records.custom action` without authentication, Access Control List (ACL), Cross-Site Request Forgery (CSRF) protection, task-trigger, content-binding, or cron-token enforcement. This allows an unauthenticated guest to provide the numeric ID of any published TF Content task and force the component to execute its configured executor immediately.

An unauthenticated remote code execution (RCE) issue exists in the `com baforms` component. The software allows administrators to define PHP code that executes after a public form submission, which supports the use of form-field shortcodes. The component fails to properly sanitize these shortcodes before passing them to the `eval()` function, replacing them with raw values submitted by the visitor. This allows an attacker to execute arbitrary code if a public form utilizes the optional PHP-after-submission action and interpolates an attacker-controlled field shortcode within a double-quoted PHP string.

An unauthenticated stored Cross-Site Scripting (XSS) issue exists in the public form upload endpoint. While the endpoint validates file extensions and MIME types, it stores the original multipart filename provided by the user verbatim in the `# baforms submissions attachments.name` field. A subsequent anonymous form submission can associate this temporary attachment with a new submission. When an administrator views the submission, the component's JavaScript retrieves the stored attachment record and concatenates the `file.name` variable directly into an HTML string, which is then assigned to `innerHTML`. XSS is a technique where malicious scripts are injected into trusted websites.

An unauthenticated path traversal issue exists where the component accepts upload-field state as guest-controlled JSON during public form submission. If the auto-reply and attach uploaded files options are enabled, the component trusts the supplied `filename` for objects with a numeric `id` and concatenates it with the upload directory without verifying ownership, session, or enforcing path containment. This allows a guest to submit a nonexistent numeric ID and a traversal filename, such as `../../../../configuration.php`, causing the system to send local files as email attachments to the submitted email address.

An unauthenticated remote code execution (RCE) issue exists because the software processes `{source}` blocks found in the final rendered HTML of Joomla without reliably determining the origin of the code. This allows for the execution of arbitrary code through unverified reflected user input.

Authenticated users can execute arbitrary shell commands with root privileges. This is possible by providing a malicious payload in the "IP address" field of the diagnosis test tools.

A sandbox bypass exists in the optional Twig safe mode feature `CMS SAFE MODE`. Certain methods on the `collect()` helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. This issue only affects installations where `CMS SAFE MODE` is enabled, which is disabled by default, and requires authenticated backend access with CMS template editing permissions.

Omega-PSIR is susceptible to a Reflected Cross-Site Scripting (XSS) issue. An attacker can create a malicious URL utilizing the `lang` parameter. When a user opens this URL, it can lead to the execution of arbitrary JavaScript code within the user's browser. The vulnerable parameter is `lang`. The affected API endpoint is not specified.