Sergiy Tryzhychynskyi

**Name of the Vulnerable Software and Affected Versions** Balbooa Forms versions prior to 2.4.3.4 **Description** An issue exists where the public `removeTmpAttachment` action allows the deletion of database rows and files by accepting an integer attachment ID. While the controller verifies a Joomla session token to prevent Cross-Site Request Forgery (CSRF)—a type of attack that forces an authenticated user to execute unwanted actions—the model fails to authorize the target object. It does not bind the attachment ID to the session that uploaded the file, the current user, the form, the upload field, or the temporary state, allowing any guest with a valid session token to delete attachments. **Recommendations** Update to version 2.4.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** Balbooa Forms versions prior to 2.4.3.4 **Description** The final form submission processes JSON arrays for each upload field but only verifies that IDs are numeric. Because client-supplied filenames and display names are trusted directly, the system is susceptible to metadata tampering, cross-session claiming, and path traversal risks, specifically through the `getFilePath()` function. **Recommendations** Update Balbooa Forms to version 2.4.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** Balbooa Forms versions prior to 2.4.3.4 **Description** An unauthenticated remote code execution (RCE) issue exists in the `com baforms` component. The software allows administrators to define PHP code that executes after a public form submission, which supports the use of form-field shortcodes. The component fails to properly sanitize these shortcodes before passing them to the `eval()` function, replacing them with raw values submitted by the visitor. This allows an attacker to execute arbitrary code if a public form utilizes the optional PHP-after-submission action and interpolates an attacker-controlled field shortcode within a double-quoted PHP string. **Recommendations** Update to version 2.4.3.4 or later.