Unauthenticated Arbitrary File Upload in Balbooa Forms

This six-file Python/PHP repository is an operational Joomla exploitation suite. CVE-2026-Joomla-Suite.py is the command-line entry point: it accepts one target or a target list, can fingerprint installed extensions, supports concurrent scanning, optional proxying and JSON output, and invokes the modules in joomla_exploits.py. It loads payloads/x7-panel.php and attempts the listed extension-specific CVE modules in sequence or a module selected with --cve. Successful deployments are logged locally in panels_joomla.txt and scan_joomla_live.log. The suite claims seven unauthenticated extension paths and includes an additional credential-dependent CVE-2026-73373/com_media path in code. The PHP payload is a functional web shell rather than a benign proof-of-concept: it exposes unauthenticated command execution, filesystem reconnaissance, and arbitrary file-writing/upload features. The only Python dependency is requests; winrarzips_brand.py provides presentation/banner code. CVE and affected-version claims are repository assertions; only the SP LMS Joomla <5.2.2 condition is explicitly stated in the supplied content.

Single-file Python exploit for CVE-2026-56291 targeting the Balbooa Forms Joomla component. The script is a mass exploiter, not just a detector: it reads a target list from user input, normalizes and deduplicates hosts, then concurrently scans targets using up to 120 threads. For each host it first fingerprints Balbooa Forms by requesting known component paths and checking for 'baforms' in responses. If detected, it attempts pre-authenticated file upload abuse against /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id={fid}&format=json across form IDs 1 through 10 and with both .php and .phtml extensions. After each upload attempt it probes likely upload directories under /images/baforms/uploads/ to find an accessible shell. The uploaded payload is a simple PHP webshell that prints php_uname() and exposes a file-upload form, enabling follow-on arbitrary file placement. Successful shell URLs are appended to shells.txt. Repository structure is minimal: one Python script containing banner/UI code, target detection logic, upload exploitation logic, shell verification, multithreaded orchestration, and result logging.

Repository contains 5 files: a Python exploit (poc.py), a Python passive scanner (scan_version.py), a Nuclei YAML detection template, a short README, and requirements.txt. The repository targets CVE-2026-56291 in Balbooa Forms for Joomla (com_baforms) affecting versions below 2.4.1. Because the repo includes a Nuclei template, it can be considered framework-associated, but the repository is not limited to Nuclei; the main offensive capability is in poc.py. That script performs host detection over HTTPS/HTTP, probing /components/com_baforms/baforms.php, /administrator/components/com_baforms/baforms.xml, and /index.php?option=com_baforms. If detection succeeds, it attempts unauthenticated file upload to /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id={fid}&format=json across multiple form IDs (1-10). It submits multipart form data with attacker-controlled name/ext fields and tries php and phtml extensions. The embedded payload is a minimal PHP command webshell using system($_GET["c"]." 2>&1"). The script then probes likely upload locations under /images/baforms/uploads/, especially /images/baforms/uploads/form-{fid}/, to find the uploaded file and confirm RCE. It supports single-target and mass-target modes, threading, optional output saving, and optional cleanup behavior. scan_version.py is a non-exploit passive scanner. It checks for exposed manifest XML files at /administrator/components/com_baforms/baforms.xml and /components/com_baforms/baforms.xml, extracting <version> when available, and falls back to /index.php?option=com_baforms for component detection. It is intended for bulk identification of potentially affected sites without uploading files. CVE-2026-56291.yaml is a Nuclei detection template, not an exploit. It performs passive HTTP GET requests to the same component paths and extracts version, creation date, and author from baforms.xml when exposed. The README briefly states the purpose: automated version scanning and exploitation for unauthenticated arbitrary file upload leading to RCE. Overall purpose: identify Joomla sites running Balbooa Forms and exploit an unauthenticated arbitrary file upload flaw to achieve remote command execution via an uploaded PHP webshell.

This repository is a small standalone Python exploit for CVE-2026-56291 targeting the Balbooa Forms Joomla extension (com_baforms) before version 2.4.1. The repo contains one main exploit script (cve_2026_56291.py), a README describing the vulnerability and usage, and a minimal requirements.txt listing requests and urllib3. The exploit is not just a detector: it performs end-to-end exploitation. Its workflow is: (1) detect Balbooa Forms by probing known component paths and the com_baforms frontend route; (2) attempt unauthenticated file upload to /index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id={fid}&format=json across multiple form IDs; (3) upload a PHP or PHTML web shell using attacker-controlled name/ext fields; (4) locate the uploaded file under /images/baforms/uploads/ and likely form-specific subdirectories; and (5) verify RCE by calling the shell with the c parameter, typically using c=id. The embedded payload is a basic PHP command-execution web shell using system($_GET["c"]." 2>&1"). The script supports single-target and mass-target modes, multithreading, debug logging, output file saving, and optional cleanup suppression via --no-cleanup. Based on the visible code and README, it is an operational exploit intended for bulk scanning and exploitation of internet-exposed Joomla sites running vulnerable Balbooa Forms versions.